gds-code-review
Pass
Audited by Gen Agent Trust Hub on Jul 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script at
{project-root}/_bmad/scripts/resolve_customization.pyto handle configuration merging. While this script is part of the vendor's intended framework, it involves executing code located within the user's project directory. - [COMMAND_EXECUTION]: The workflow dynamically constructs and runs shell commands using
gitandgh(GitHub CLI). These commands incorporate user-supplied parameters such as branch names, commit SHAs, and file paths to generate the diffs for review. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted project data.
- Ingestion points: The skill reads content from git diffs, story/specification files (e.g.,
{spec_file}), and general project documentation (project-context.md). - Boundary markers: The instructions do not specify the use of robust boundary markers (like XML tags or unique delimiters) when passing this untrusted content to the 'Blind Hunter', 'Edge Case Hunter', or 'Acceptance Auditor' subagents.
- Capability inventory: The agent has the ability to execute shell commands, run local Python scripts, and perform file-write operations to update story files and sprint status documents.
- Sanitization: There is no evidence of content sanitization or validation performed on the ingested data before it is interpolated into the prompts for the review subagents.
Audit Metadata