codacy-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
codacy-analysisandcodacyCLI tools to gather code quality and coverage data. This is the intended primary purpose of the skill and uses vendor-provided tools to analyze the repository. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including pull request titles, descriptions, and linked tickets from providers like GitHub, GitLab, Jira, or Linear.
- Ingestion points: Metadata and ticket content are fetched in Step 1 and Step 3 of the review workflow and interpolated into the review summary.
- Boundary markers: The instructions do not specify the use of delimiters or warnings to prevent the agent from following instructions potentially embedded in the external content.
- Capability inventory: The agent uses vendor CLI tools to perform its tasks based on the ingested metadata.
- Sanitization: No specific validation or filtering of the fetched external data is described before it is presented to the user in the final summary.
Audit Metadata