cs-code-review
Warn
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
ocrCLI tool with arguments (such as the feature slug) derived from repository files like design documents. If these files are modified by an attacker, they could contain shell metacharacters designed to perform command injection. - [PROMPT_INJECTION]: The skill is susceptible to Indirect Prompt Injection. It ingests untrusted data from
git diffand source code files into the context of both the main agent and a dedicated reviewer sub-agent. Malicious instructions hidden in comments or code could attempt to manipulate the review verdict or extract information. - Ingestion points:
git diff,git status, and source code files identified in the current scope. - Boundary markers: The sub-agent prompt lacks explicit delimiters or instructions to ignore embedded commands within the files being reviewed.
- Capability inventory: The agent has capabilities for shell command execution (
ocr), file reading/writing, and creating sub-agents via MCP tools (mcp__paseo__create_agent). - Sanitization: No sanitization or filtering of the code content is performed before processing.
Audit Metadata