py-review
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted user-provided code and repository metadata, which is an inherent surface for indirect prompt injection.
- Ingestion points: As described in SKILL.md, the agent is instructed to orient on the project context by reading changed files, git status output, git diffs, and project configuration files like pyproject.toml and setup.cfg.
- Boundary markers: The instructions do not define specific delimiters or explicit 'ignore instructions' warnings for the code content being reviewed.
- Capability inventory: The skill relies on local file system access and standard version control commands (git). It does not include commands for network operations, privilege escalation, or arbitrary code execution.
- Sanitization: The skill includes a dedicated 'Sensitive Evidence Safety' section that explicitly instructs the agent to identify potential secrets without quoting or reproducing them in reports, effectively providing a manual sanitization step to prevent accidental exfiltration.
Audit Metadata