gemini-review
Warn
Audited by Snyk on Feb 27, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's scripts (scripts/gemini-review.sh -> get_pr_diff) use the GitHub CLI to checkout and gh pr view a pull request, include the PR title/body and diff in the prompt passed to the Gemini model, thereby ingesting untrusted, user-generated GitHub PR content into the agent's decision-making flow.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The script uses the GitHub CLI (gh) to fetch a PR's title/body from GitHub (https://github.com/...) at runtime via
gh pr viewand injects that content directly into the Gemini prompt, meaning remote PR content can control the agent's instructions.
Audit Metadata