code-review-playbook
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides architectural patterns and code examples for building automated reviewer agents that are susceptible to indirect prompt injection attacks.
- Ingestion points: Untrusted data from external sources, specifically pull request diffs (
prDiff) and source code files (code), are interpolated directly into prompts in theperformDeepCodeReviewandperformSecurityReviewfunctions withinSKILL.md. - Boundary markers: The provided prompt templates utilize basic Markdown headers but lack robust structural delimiters (such as specific XML tags) or explicit instructions for the AI to disregard instructions contained within the ingested code.
- Capability inventory: The suggested implementation leverages deep reasoning models to perform security scans and architectural analysis, creating a pathway where malicious instructions in a PR could influence the agent's verdict.
- Sanitization: The implementation examples do not include or recommend sanitization, escaping, or filtering of the input code before it is passed to the LLM.
Audit Metadata