glm-review
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect prompt injection surface identified. Untrusted data from repository files is interpolated into review prompts while the agent is operating with file-writing capabilities.
- Ingestion points: The skill reads content from files defined by the input_file, spec_path, and plan_path variables, as well as the output from git diff commands.
- Boundary markers: Prompt templates use horizontal separators (---) and structural headers to isolate instructions from the ingested content.
- Capability inventory: The skill invokes the claude CLI with the --permission-mode acceptEdits flag (granting file-write access) and performs network requests to the api.z.ai endpoint.
- Sanitization: No evidence of explicit escaping or validation of the ingested repository file content was observed prior to prompt interpolation.
- [DATA_EXFILTRATION]: The skill transmits repository source code and documentation to the Zhipu AI service (api.z.ai) to facilitate the review process.
- [COMMAND_EXECUTION]: The skill executes the claude CLI as a subprocess and explicitly enables the acceptEdits permission mode, which allows the model to modify local files without manual user confirmation.
Audit Metadata