review-and-fix
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes 'accepted findings prose' labeled as 'untrusted reviewer data' to apply code fixes, creating an indirect prompt injection surface.
- Ingestion points: External data is ingested via the file path specified in the
--findings-fileargument. - Boundary markers: Instructions mandate treating prose as data and explicitly forbid access to sensitive paths like
.git/or.gitmodules. - Capability inventory: The skill uses the
Bashtool to run local scripts and file system tools (Read,Grep,Glob) to modify the code. - Sanitization: Implements multiple mitigations including a Rust-based filter (
redact scrub-submodule-paths) and a post-execution reversion of unauthorized submodule changes. - [COMMAND_EXECUTION]: The skill invokes the
Bashtool to run a vendor script (larch.sh) using variables passed from$ARGUMENTS. - Evidence:
"${CLAUDE_PLUGIN_ROOT}/scripts/larch.sh" review-and-fix apply-findings --findings-file "$FINDINGS_FILE" --review-tmpdir "$REVIEW_TMPDIR". - Risk: User-controlled arguments are interpolated into a shell command, which necessitates rigorous validation by the script to prevent path traversal or command injection.
Audit Metadata