fix-findings
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes finding data sourced from external locations like Pull Request ledgers or terminal logs. This text is passed to sub-agents to guide code fixes, creating a surface where malicious instructions in findings could influence the agent's actions. * Ingestion points: Finding text is read from the session history or the 'Review Disposition Ledger' on a PR (SKILL.md Step 1). * Boundary markers: The instructions do not specify using delimiters or 'ignore' instructions for the finding content passed to sub-agents. * Capability inventory: Sub-agents have filesystem write access and can create git commits. * Sanitization: No explicit validation or escaping of the ingested finding text is performed before interpolation.
- [DYNAMIC_CONTEXT_INJECTION]: A shell command is executed at skill load time using the '!' syntax. This command is used for project-specific state management, specifically creating a lock file to track active fix rounds. Evidence found in SKILL.md:
!PROJECT_DIR=\"${CLAUDE_PROJECT_DIR:-$(git rev-parse --show-toplevel)}\" && mkdir -p \"$PROJECT_DIR/.claude\" && touch \"$PROJECT_DIR/.claude/.fix-findings-active\" ... - [COMMAND_EXECUTION]: The skill automates several shell commands including git operations (status, log, archive), directory management (mktemp, mkdir), and project test suites. These are standard for a developer productivity tool but involve executing code based on repository state.
Audit Metadata