reviewing-dependency-changes
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill relies on processing untrusted data (PR descriptions and manifest diffs) to determine if a security process has been followed, which creates a vulnerability to deceptive content.
- Ingestion points: The agent reads the PR description and manifest files (
package.json,Cargo.toml, etc.) as defined inSKILL.mdunder the 'Manifest File Detection' and 'Area 1: New Dependencies' sections. - Boundary markers: None. There are no instructions for the agent to treat the PR description as untrusted data or to use specific delimiters to separate user content from system instructions.
- Capability inventory: The skill directs the agent to evaluate compliance and emit specific 'IMPORTANT' or 'QUESTION' warnings based on the content of the PR.
- Sanitization: None. The skill instructs the agent to look for 'approval signals' like a
VULNtask reference. A malicious actor could include a fake or unrelated task ID to trick the agent into assuming a security review was completed.
Audit Metadata