review-pr
在 kimi-code 仓库里 review 一个 PR 时使用：按 PR 模板逐节核对描述与 diff，并单独做一轮"回归与用户影响"评审，给出影响等级与评审摘要，评审摘要用用户当前使用的语言。
73
92%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow instructs the agent to review a pull request by fetching its metadata and diff via the `gh pr` CLI tool, which ingests outsider-authored free text from GitHub PR titles, descriptions, and diffs.
- Repository
- MoonshotAI/kimi-code
- Commit
21406fb
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.