review-fix-loop
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage agent threads and resolve project environments.
- Evidence: Usage of
bb-cliandbb thread wait <id> --timeout 1200 --jsonfor environment resolution and worker monitoring. - Context: These commands are used to interact with the platform's native tooling for managing agent lifecycles and Git worktrees.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from issue trackers or specification documents, which could serve as a vector for indirect injection.
- Ingestion points: Worker prompts in
SKILL.mdincorporate content from "attached spec or ticket" references. - Boundary markers: The prompts lack explicit isolation delimiters (e.g., XML tags or specific headers) between instructions and the untrusted external content.
- Capability inventory: The skill can execute shell commands, spawn subagents, and commit code changes to the repository.
- Sanitization: The skill implements a verification step where a separate "finding checker" must confirm citations against the source code before a fix is attempted, providing a logical gate against spurious instructions.
Audit Metadata