auto-review-loop-llm
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill explicitly instructs the agent to bypass user confirmation and interaction during automated file-writing recovery processes. Evidence: "Do NOT ask the user for permission — just do it silently" in the Large file handling section.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it requires the agent to read and implement instructions from external LLM responses that are ingested verbatim without sanitization.
- Ingestion points: External LLM API responses from the
llm-chatMCP server andcurlfallback. - Capability inventory: High-privilege tools including
Bash(*),Write, andEditare used to implement the external suggestions. - Sanitization: Explicitly absent; the skill instructs the agent to paste responses "verbatim, unedited".
- Boundary markers: No delimiters or protective framing are used when processing the external content.\n- [DATA_EXFILTRATION]: The skill transmits project context, including research methods and results, to external API endpoints. While the target services are well-known LLM providers, this constitutes an intentional flow of potentially sensitive data to third-party endpoints.\n- [COMMAND_EXECUTION]: The skill instructs the agent to dynamically generate and execute shell commands to handle large file operations.
- Evidence: Instructions to use
cat << 'EOF' > filevia the Bash tool to manage large writes.
Audit Metadata