review
Warn
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: MEDIUMINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface since it processes untrusted user code and diff inputs while holding extensive capabilities.
- Ingestion points: Ingests arbitrary source code diffs via the
--diffflag and repository files under review in SKILL.md and references/heavy-worker.md. - Boundary markers: Lacks explicit structural delimiters or instructions to prevent the model from executing natural language commands embedded within the source files being reviewed.
- Capability inventory: Possesses capabilities to execute shell commands via the Bash tool and modify files via the Edit and Write tools.
- Sanitization: Lacks sanitization mechanisms to filter malicious instructions contained within code comments or files under review.
- [DYNAMIC_EXECUTION]: The skill utilizes dynamic execution by invoking a script from a dynamically computed path involving the process ID variable ($PPID) in SKILL.md.
Audit Metadata