diff-intake
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it instructs the agent to read and process the full content of code files and diffs from external sources (pull requests and branches) without boundary markers.
- Ingestion points: Untrusted data enters the agent's context through the output of
gh pr viewandgit diffcommands, specifically when the agent is directed to "Read every single Core Logic file" in Step 2 ofSKILL.md. - Boundary markers: The instructions do not define delimiters or provide warnings to the agent to disregard natural language instructions that might be embedded within the code or diff content being analyzed.
- Capability inventory: The skill has the capability to execute shell commands using
gitand the GitHub CLI (gh). - Sanitization: There is no evidence of sanitization, filtering, or validation of the ingested code content to prevent the agent from obeying instructions hidden in the data.
Audit Metadata