tessl/code-review-setup
Install Tessl Code Review into a GitHub repository. Inspects the repository's existing workflows and any Code Review caller already present, asks the two setup questions (when reviews run, and whether findings block the merge), then writes or updates a thin caller workflow that invokes the Tessl Code Review Action. Use when someone wants to add, set up, enable, configure, update, or remove Tessl Code Review, AI code review, or automated pull-request review in a repository, or asks to switch it between advisory and gate mode.
87
97%
Does it follow best practices?
Impact
72%
0.94xAverage score across 5 eval scenarios
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
In the installed caller workflow templates, the job trigger and Action invocation ingest outsider-authored comment text from `github.event.comment.body` (e.g., `on: issue_comment` / `pull_request_review_comment`) and pass the PR context to `tesslio/code-review-action` when the body contains `@tessl-code-review`, creating an indirect prompt-injection exposure path via user-controlled free text.
- Audited
- Security analysis