aiden-review-pr
Pass
Audited by Gen Agent Trust Hub on May 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
git remote get-url originto resolve the repository's owner and name from the local environment when a full URL or reference is not provided. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and acting upon untrusted data from external GitHub pull requests.
- Ingestion points: Untrusted data enters the agent context via
mcp__aiden__github_get_pull_request(descriptions),mcp__aiden__github_get_pr_diff(code diffs), andmcp__aiden__github_list_pr_comments(user comments) as described in the Workflow section ofSKILL.md. - Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' prompts when processing the fetched GitHub data.
- Capability inventory: The skill has significant capabilities including
mcp__aiden__github_create_pr_review,mcp__aiden__github_add_comment, andmcp__aiden__github_merge_pull_request, which could be abused if the agent obeys instructions hidden in PR content. - Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from the GitHub API before it is processed by the agent.
Audit Metadata