ext-self-review-plan-marshall
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script uses
subprocess.runto execute Git commands such asdiff,merge-base, andrev-parse. These calls use a list-based argument format which prevents shell injection, and the operations are restricted to the Git binary within the project directory. Evidence found inscripts/_self_review_diff.pyandscripts/self_review.py. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface (Category 8). It extracts raw strings, comments, and code snippets from unvetted source files and diffs to be processed by a downstream AI agent.
- Ingestion points: Untrusted data enters the context via
_diff_hunks(Git output) and_read_post_image(local file contents) inscripts/_self_review_diff.py. - Boundary markers: Absent. Extracted data is placed directly into structured TOON output fields (e.g.,
text,pattern,description) without delimiters or "ignore instructions" warnings. - Capability inventory: The skill performs file reads (
_read_post_image) and subprocess calls to Git (subprocess.run). - Sanitization: Only length-based truncation (
_truncate) is performed; there is no filtering or escaping of potential prompt-injection keywords or instructions in the extracted content.
Audit Metadata