dev6-review-fix
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the
.llm/$ARGUMENTS/tmp_review.mdfile, which contains review comments that the agent is instructed to follow and apply as code fixes. If these comments contain malicious instructions (e.g., "Delete all files" or "Exfiltrate the .env file"), the agent might execute them while attempting to 'apply the fix'. - Ingestion points:
.llm/$ARGUMENTS/tmp_review.md(read in Step 1). - Boundary markers: Absent. The skill does not provide delimiters or instructions to the agent to treat the file content strictly as data or to ignore embedded instructions.
- Capability inventory: The agent has the ability to read and write files across the repository, run tests, and execute git commands.
- Sanitization: None. The skill does not specify any validation or filtering of the review comments before processing.
- [COMMAND_EXECUTION]: The skill provides a bash command for committing fixes that directly interpolates the
$ARGUMENTSvariable:git commit -m "fix: address review comments for $ARGUMENTS". If a user or an upstream process provides a feature name containing shell metacharacters (e.g.,feature; rm -rf /), it could lead to arbitrary command execution if the agent platform does not sanitize the variable before execution.
Audit Metadata