code-review-report
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local
gitcommands (status,diff,log) to collect information about code changes and commit history. It also runs a provided Python script (inline_hljs.py) to post-process the generated HTML report and utilizes system-specific commands (open,xdg-open,start) to open the final report in the user's browser. - [PROMPT_INJECTION]: The skill ingests untrusted data from the local repository (such as diffs, logs, and untracked file content) and interpolates it into prompts for subagents. This constitutes an indirect prompt injection surface.
- Ingestion points: Data is ingested through
git diff,git log, and direct file reads of untracked files identified viagit status(SKILL.md, Step 1 & 2). - Boundary markers: The skill uses markdown headers and clear section labeling in the subagent prompt skeleton to separate the working context from instructions (references/review-perspectives.md).
- Capability inventory: The main agent has capabilities to write files and execute local shell commands; subagents are restricted to analyzing the provided code context (SKILL.md, Step 3 & 5).
- Sanitization: The skill does not explicitly sanitize the ingested git content, relying on the agent's internal safety filters and the descriptive context provided to the subagents to manage potential injection risks.
Audit Metadata