review-work
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses several shell commands to gather context for the review process, including
git diff,git log,git worktree, and theghCLI for GitHub interactions. - [REMOTE_CODE_EXECUTION]: The QA sub-agent (Agent 2) is explicitly instructed to execute the application being reviewed using commands found in the repository's configuration files (e.g.,
package.jsonscripts,Makefiletargets). While this is the intended purpose of the QA agent, it represents an execution surface for code contained within the analyzed repository. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It collects untrusted data from file contents, git history, and external tools (Slack, Notion, GitHub Issues) and interpolates this data into the prompts of specialized sub-agents. Although it uses XML-like delimiters (e.g.,
<file_contents>), it lacks explicit instructions to the sub-agents to ignore potentially malicious commands embedded within that data. - Ingestion points: Reads repository files, git logs, Slack messages, Notion docs, and GitHub PR/Issue comments.
- Boundary markers: Uses
<tag>delimiters for context interpolation but does not include 'ignore embedded instructions' warnings. - Capability inventory: Sub-agents have access to browser tools (
playwright,dev-browser), file reading, and command execution. - Sanitization: No explicit sanitization or filtering of external content before interpolation.
Audit Metadata