code-review
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted content from Git diffs, commit messages, and external specification files (PRDs/Issues) and interpolates this data directly into the instructions for sub-agents. It does not use boundary markers (e.g., XML tags or specific delimiters) to isolate this external data from the sub-agent's system instructions, allowing for potential indirect prompt injection if a commit contains malicious instructions.
- Ingestion points: Git diff output, commit logs, and content from files under
docs/orspecs/(SKILL.md, Sections 1 and 2). - Boundary markers: No delimiters or isolation instructions are present in the prompt templates defined for sub-agents (SKILL.md, Section 4).
- Capability inventory: The skill uses the
Agenttool to spawn sub-tasks and executes Git commands in the local shell environment. - Sanitization: There is no evidence of sanitization or escaping of the content extracted from diffs or specs before it is passed to the sub-agents.
Audit Metadata