pr-review-loop
Pass
Audited by Gen Agent Trust Hub on Feb 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [Indirect Prompt Injection] (LOW): The skill processes PR comments from GitHub, which are untrusted external inputs.
- Ingestion points: Fetches PR comments via
gh apiinSKILL.md(Step 3). - Boundary markers: Absent; the agent is not instructed to ignore commands within the comments.
- Capability inventory: Access to
Bashfor command execution,git pushfor repository modification, andghAPI for GitHub interaction. - Sanitization: Absent; the agent implements changes based directly on comment text.
- [Command Execution] (LOW): The skill executes 'safeguards' such as
Makefiletargets or test scripts found in the repository (Steps 1 and 5b). While necessary for its purpose, this executes code that could be malicious if the PR being reviewed is from an untrusted source. - [Command Execution] (LOW): Step 6 in
SKILL.mduses a shell loop to iterate overthread_idvalues from the GitHub API. The interpolation of variables into shell commands is a risky pattern that could lead to command injection if the input source were compromised.
Audit Metadata