github-code-review
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses standard CLI tools (git, gh) and the official GitHub API to perform its functions. The retrieval of credentials from local files like ~/.git-credentials and ~/.hermes/.env is a documented setup step for authentication with the well-known service GitHub.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection as it processes untrusted data from git diffs and Pull Request content.
- Ingestion points: Untrusted data enters the context through
git diffoutput,gh pr viewresponses, and Pull Request metadata fetched via the GitHub API inSKILL.md. - Boundary markers: The skill does not implement specific delimiters or instructions to ignore embedded commands within the code diffs or PR descriptions.
- Capability inventory: The agent has the capability to write to the repository environment via
git checkoutand perform network writes to the GitHub API viacurlandghto post comments or approve PRs. - Sanitization: No explicit sanitization or escaping of external PR content is performed before the agent processes the information for its review.
Audit Metadata