review-context-hub
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and summarize standing instruction files (e.g., CLAUDE.md, AGENTS.md) and project-specific skills. This data ingestion path is vulnerable to indirect prompt injection if those files contain malicious instructions intended to subvert the agent's behavior.
- Ingestion points: The skill reads CLAUDE.md, AGENTS.md, GEMINI.md, and SKILL.md files from the repository as specified in SKILL.md sections 3 and 4.
- Boundary markers: There are no explicit instructions to use delimiters or ignore embedded instructions within the ingested files.
- Capability inventory: The agent has access to the Bash tool and gh CLI, providing significant potential for impact if an injection is successful.
- Sanitization: The skill does not define any sanitization or validation logic for the content read from the repository.
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute a variety of shell commands for repository inspection.
- Evidence: reference/checklist.md contains shell primitives for find, rg, git, and gh (GitHub CLI).
Audit Metadata