code-review
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from
/tmp/pr-threads.jsonand pull request comments, which could theoretically contain malicious instructions. - Ingestion Points: Data is ingested via the
Readtool from a temporary JSON file and from$ARGUMENTS. - Boundary Markers: The skill utilizes explicit XML-like tags (e.g.,
<threads>) when passing data to the subagent and provides clear instructions on which parts of the data to trust. - Capability Inventory: The skill itself is restricted to reading local configuration and invoking a specific subagent (
bitwarden-code-review:bitwarden-code-reviewer) via theTasktool. - Sanitization: There is robust sanitization for the pull request number, including a strict regex check (
^[0-9]+$) and instructions to disregardPR NUMBER:lines found within contributor-authored content to prevent hijacking attempts.
Audit Metadata