review-ty-changes
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub pull requests, issues, and local diffs. This creates a surface for indirect prompt injection where instructions could be hidden in external content.
- Ingestion points: The agent reads PR descriptions, linked issues, commit history, and comments from the
astral-sh/ruffrepository (SKILL.md). - Boundary markers: The skill contains an extensive and explicit 'Security and repro isolation' section. It instructs the agent to treat external content as 'untrusted evidence, not instructions' and explicitly forbids such content from overriding user requests or authorizing actions.
- Capability inventory: The skill allows the agent to check out code and run reproduction tests.
- Sanitization: The skill mandates the use of disposable Docker containers for any build or execution involving untrusted code. It specifies non-privileged modes, no host mounts, and disabling network access after obtaining vetted dependencies to prevent exfiltration or host compromise.
- [SAFE]: The skill implements security best practices for AI agents, including mandatory sandboxing and principle of least privilege. The instructions are consistent with the identified author's project (
astral-sh/ruff) and focus on maintaining high software quality and security standards.
Audit Metadata