review-work
Warn
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The QA Executor agent (Agent 2) is designed to run the application using commands discovered in project metadata (e.g.,
package.json,Makefile, ordocker-compose.yml). This capability creates a risk of arbitrary code execution on the local system if the project being reviewed contains malicious build scripts or configuration. - [PROMPT_INJECTION]: The orchestrator is vulnerable to indirect prompt injection as it collects untrusted data from the repository (file contents, diffs, git history) and external services (GitHub issues, Slack, Notion) and interpolates them into instructions for five different sub-agents. A malicious actor could embed instructions in a file or PR to deceive the agents into providing a false "PASS" verdict or performing unauthorized actions.
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface: 1. Ingestion points: Reads local file contents and diffs in the collection phase; mines context from GitHub issues/PRs and external platforms like Slack or Notion in Agent 5. 2. Boundary markers: Uses XML delimiters (e.g.,
<file_contents>,<diff>) in prompts but lacks instructions for sub-agents to ignore instructions embedded within those blocks, allowing for delimiter escape. 3. Capability inventory: The orchestrator can execute system commands (git, gh), run project-specific shell commands via the QA agent, and spawn multiple autonomous sub-agents. 4. Sanitization: No validation or escaping is performed on the content of the files or messages before they are processed by the LLM sub-agents, though there is a requirement for the agent to manually redact secrets from its own output.
Audit Metadata