review-changes
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted data from the local repository and external sources like pull requests.
- Ingestion points: The skill reads data from
git diff, file system reads (e.g.,.safe-code/context/code-standards.md,.safe-code/context/feature-specs/), and pull request content via thePR numberargument. - Boundary markers: The instructions lack specific delimiters or "ignore embedded instructions" warnings, which could allow malicious code comments in the analyzed diff to influence the agent's review behavior.
- Capability inventory: The skill uses tools like
git,rg, and specialized graph analysis tools. While these are primarily read-only, the agent's output is based on the interpretation of this untrusted content. - Sanitization: There is no mention of sanitizing or escaping the content of the code or diffs before the agent processes them, creating a surface where an attacker could attempt to bias the review axis results.
Audit Metadata