cdk-regression-review
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest and analyze pull request diffs and authoritative documentation. Because pull request content is provided by external contributors, it is considered untrusted data that could potentially contain instructions aimed at influencing the agent's behavior during the review process.
- Ingestion points: The agent processes pull request diffs and searches for related service documentation.
- Capability inventory: The skill allows the agent to search for documentation and generate structured review findings based on analyzed code.
- Boundary markers: The skill specifies that the agent should populate structured finding fields, which provides a level of separation between the analyzed content and the agent's final report.
- Sanitization: There are no specific instructions for escaping or validating the content of the diffs before they are processed by the agent.
- External Resource References: The skill references external guidelines and documentation from official AWS domains and GitHub repositories to verify its review findings. These references are used for information gathering as part of the intended review process.
Audit Metadata