flow-review
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill aggregates untrusted data (tickets, code, attachments) to be processed by a reviewer agent, creating a surface for indirect prompt injection.\n
- Ingestion points: Reads from
.task/folder, Git diffs, ticket sources, and attachments as specified inSKILL.mdandreferences/prompt.md.\n - Boundary markers: Instructions in
references/prompt.mdestablish a review context, but the skill lacks technical delimiters to separate instructions from the data being reviewed.\n - Capability inventory: The agent has the capability to execute secondary tools and write reports to the filesystem in the
reviews/directory.\n - Sanitization: The skill includes explicit instructions for shell escaping and treating content as data, providing a defense-in-depth layer against command injection when calling the reviewer tool.\n- [COMMAND_EXECUTION]: The skill involves launching external review tools via shell commands, which is a standard part of its workflow.\n
- Evidence:
SKILL.mdprovides guidance on selecting non-interactive commands and emphasizes the importance of proper argument escaping to prevent malicious content in tickets or diffs from being executed as shell code.
Audit Metadata