gemini-review-code

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill intentionally sends repository diffs and untracked file contents to a cloud agent (agy) with the agent granted read access to the repo and uses agy "print" mode that auto-runs tool calls, creating a high risk of data exfiltration and prompt-injection–driven remote actions.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). The required workflow embeds the git diff and contents of any new untracked files (which may include outsider-authored code, e.g., from a third-party PR) as inline free text in the BRIEF prompt passed to agy --print, creating an indirect prompt-injection path via the “Changed files/Diff/New (untracked) files” sections.