application-security-secure-code-review
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external code diffs provided to the agent. This introduces a surface where malicious instructions could be hidden within the analyzed code to influence the agent's output.
- Ingestion points: Analyzes code diffs provided in the conversation context (SKILL.md).
- Boundary markers: No specific delimiters or instructions are provided to the agent to treat the analyzed code as untrusted data.
- Capability inventory: The skill does not define any executable scripts, file system write operations, or network calls; it is purely instructional.
- Sanitization: There is no explicit sanitization or filtering of the input code content.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install its components from the author's public GitHub repository using the skills CLI tool.
Audit Metadata