ai-review-changes
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted content that could contain malicious instructions to subvert the review process.
- Ingestion points: Git diff output, commit logs, external issue tracker data, and various local file paths (
docs/,specs/,.scratch/, and Obsidian vaults). - Boundary markers: Absent. The diff and spec contents are interpolated directly into the sub-agent prompts without delimiters or instructions to ignore embedded instructions.
- Capability inventory: Shell execution (
gitcommands) and local file read operations. - Sanitization: None. The skill processes the raw content of diffs and specs without sanitization.
- [COMMAND_EXECUTION]: The skill instructs the agent to run
gitcommands (e.g.,git diff,git rev-parse) using user-supplied references. This pattern is vulnerable to command injection if the underlying shell execution environment does not properly sanitize these arguments. - [DATA_EXPOSURE]: The skill reads files from the local filesystem using absolute paths, including paths involving the
$OBSIDIAN_AI_VAULTenvironment variable. This allows the agent to access files outside the immediate repository context.
Audit Metadata