receiving-code-review
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from external code reviewers, creating a potential surface for indirect instructions.
- Ingestion points: External reviewer feedback strings processed during the 'Response Pattern' in SKILL.md.
- Boundary markers: The instructions explicitly mandate verification against the codebase ('Verify before implementing') and require the agent to 'be skeptical' of external feedback.
- Capability inventory: The skill utilizes
grepfor codebase searching, the GitHub CLI (gh api) for interaction with pull request comments, and performs file-write operations to implement fixes. - Sanitization: Verification against the existing codebase and technical cross-referencing act as a logic-based validation step for proposed changes.
Audit Metadata