code-structure-review
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data in the form of code changes, git diffs, and pull request information provided via the
$ARGUMENTSparameter. - Ingestion points: The agent reads file contents and structural data from the local repository based on user-supplied commit ranges or paths (SKILL.md, Target section).
- Boundary markers: There are no explicit instructions to use boundary markers or delimiters when processing the target code to prevent the model from interpreting code comments or strings as instructions.
- Capability inventory: The skill is strictly "report-only" and explicitly instructs the agent not to edit, stage, or commit changes. No network operations or administrative shell commands (beyond
git status) are present. - Sanitization: No sanitization of the input code is specified.
- Note: While the ingestion of external data constitutes an attack surface, the risk is minimal because the skill lacks the capabilities (like network access or file writes) required to act on injected instructions maliciously.
Audit Metadata