review
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted code from git diffs, PRs, and file paths, creating a surface where malicious instructions embedded in comments or strings could potentially influence the agent.
- Ingestion points: External data enters the context through git diff, gh pr diff, and directory enumeration as described in SKILL.md.
- Boundary markers: The skill does not define clear delimiters or use 'ignore embedded instructions' warnings when passing untrusted code to subagents.
- Capability inventory: The skill possesses the ability to spawn subagents, read the file system, and execute git commits in 'Self' mode.
- Sanitization: There is no evidence of sanitization or escaping of the ingested code before it is processed by the AI models.
Audit Metadata