design-review
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it reads and analyzes untrusted external documentation (such as design.md, tasks.md, and plan.md) provided via the path argument. Maliciously crafted instructions within these files could influence the subagent's review results or the main agent's logic for fixing identified issues. The prompts provided to the subagents lack boundary markers or explicit instructions to disregard embedded commands or directives in the analyzed content.\n
- Ingestion points: Documentation files read from the user-specified directory or file path in SKILL.md (Step 1 and Step 2).\n
- Boundary markers: No explicit delimiters or 'ignore embedded instructions' warnings are used when interpolating file content into subagent prompts.\n
- Capability inventory: Spawns subagents via the Agent tool, performs filesystem writes to 'fix' document issues, and interacts with GitHub issues via comments.\n
- Sanitization: The skill does not perform sanitization, escaping, or validation of the documentation content before processing.\n- [COMMAND_EXECUTION]: The subagent prompts for 'Implementation Plans' and 'Design / Architecture' documents require the agent to verify quantitative and performance claims via 'actual measurement' ('实测'), including providing the 'exact command + output'. This instruction could lead the agent to execute arbitrary shell commands if it attempts to fulfill the verification requirement using commands suggested or implied by the untrusted design document.
Audit Metadata