review
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it ingests untrusted data from git diffs and external code.
- Ingestion points: The workflow relies on reading output from
git diffandgit status, as well as code diffs provided by the user (SKILL.md). - Boundary markers: There are no explicit instructions or delimiters used to ensure the agent ignores instructions potentially embedded within the code or diff content being reviewed.
- Capability inventory: The agent is empowered to execute shell commands for running tests, linting, and vulnerability scans (
trivy fs), and can modify the local file system to apply fixes (SKILL.md). - Sanitization: The skill does not implement sanitization or validation of the diff content before it enters the model's context or influences command execution.
Audit Metadata