pr-review

{
  "repo": "Levanto/Levanto-Aion",
  "review": {
    "summary": "The PR is presented as a docs-and-script cleanup but actually ships two undisclosed code changes, including a rewrite of the merge-gating review agent that now inlines the full untrusted PR body and diff into the verdict-producing prompt (a prompt-injection surface against a merge/deploy gate). The self-reviewed '0 findings' claim does not cover the real changeset. The workflow rename is a legitimate latent-bug fix but is unexplained; confidence is high that the scope misrepresentation and injection surface are real and blocking.",
    "verdict": "changes_requested",
    "findings": [
      {
        "file": "agents/review-agent/agent.py",
        "lens": "security",
        "line": 64,
        "finding": "Attacker-controlled PR body and unified diff are interpolated verbatim into the review prompt whose verdict gates merges/deploys (aion/review status + feature-to-prod approved→cicd), with no delimiting or untrusted-data framing, creating a prompt-injection path to flip the verdict to 'approved'.",
        "severity": "major"
      },
      {
        "file": "agents/review-agent/agent.py",
        "lens": "operational",
        "line": 59,
        "finding": "This substantive logic change to the merge-gating review agent is undisclosed in the PR description, which claims a docs-only change with a self-reviewed 0/0/0, so the stated scope is false and the change risks being merged unscrutinized by anyone trusting the body.",
        "severity": "major"
      },
      {
        "file": "workflows/ci-pipeline/workflow.py",
        "lens": "operational",
        "line": 54,
        "finding": "Undisclosed state rename ci-quality→ci_quality; although it correctly aligns the state name with the existing ci_quality guards (a latent-bug fix), it is unexplained in the PR and leaves the only underscore-named state among otherwise hyphenated peers.",
        "severity": "minor"
      },
      {
        "file": "agents/review-agent/agent.py",
        "lens": "architecture",
        "line": 58,
        "finding": "The new github.list_pull_request_files call at the boundary has no local error handling, so a transient GitHub API failure aborts the entire review and relies solely on framework retry for graceful degradation.",
        "severity": "minor"
      },
      {
        "file": "docs/QUICKSTART.md",
        "lens": "security",
        "line": 23,
        "finding": "Documents storing the API bearer token in browser localStorage as the standard onboarding flow, which is an XSS-exfiltration exposure worth flagging even though it reflects pre-existing dashboard behavior.",
        "severity": "minor"
      }
    ]
  },
  "base_ref": "main",
  "head_sha": "16e3a57084a3ccaf115cfa60f3a28dea6dcf772e",
  "pr_number": 16,
  "post-comment": {
    "posted": {
      "posted": true,
      "pr_number": 16,
      "body_chars": 2503,
      "comment_id": 4529538072
    }
  },
  "changed_files": [],
  "dashboard_url": "http://aion.levanto.in/runs/75163b08-b866-412c-8a8f-cae75fcd6e2a",
  "status-failure-review": {
    "posted": {
      "sha": "16e3a57084a3ccaf115cfa60f3a28dea6dcf772e",
      "state": "failure",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/75163b08-b866-412c-8a8f-cae75fcd6e2a"
    }
  },
  "status-pending-review": {
    "posted": {
      "sha": "16e3a57084a3ccaf115cfa60f3a28dea6dcf772e",
      "state": "pending",
      "posted": true,
      "context": "aion/review",
      "target_url": "http://aion.levanto.in/runs/75163b08-b866-412c-8a8f-cae75fcd6e2a"
    }
  }
}