github-pr-fixer
Fail
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automatically installs a third-party GitHub CLI extension
agynio/gh-pr-reviewfrom an external source during its prerequisite check. - [REMOTE_CODE_EXECUTION]: By installing and subsequently executing the
gh-pr-reviewextension, the skill runs unverified code from a non-standard repository on the user's system. - [COMMAND_EXECUTION]: The skill executes auto-detected commands from local project files (e.g.,
package.json,Makefile,pyproject.toml) during the verification phase, includingnpm run lint,pytest, andgolangci-lint, which can lead to the execution of malicious scripts if the project files are compromised. - [PROMPT_INJECTION]: The skill is highly vulnerable to Indirect Prompt Injection (Category 8):
- Ingestion points: Fetches untrusted data from GitHub PR discussion comments and inline review comments via
gh api(SKILL.md). - Boundary markers: None identified. The instructions do not define delimiters or provide warnings to the agent about ignoring embedded instructions in the comments.
- Capability inventory: Includes file modification (Edit tool), local command execution (
npm,pytest,gh), and network operations (git push,gh api) across all phases. - Sanitization: None. The skill directly analyzes and acts upon the content of the fetched comments to implement code changes.
Recommendations
- AI detected serious security threats
Audit Metadata