string-reviewer
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-facing strings and UI text directly from the codebase, specifically referencing files like
packages/cli/src/config/settingsSchema.ts. This ingestion of external data creates a potential surface for indirect prompt injection if a string in the codebase contained malicious instructions. - Ingestion points: The skill reads inline text, error messages, and configuration schema files.
- Capability inventory: The skill is limited to providing textual analysis and suggestions in a specific markdown format. It does not have access to tools for file writing, network operations, or system commands.
- Sanitization: The instructions include a strict requirement that the agent 'must only suggest changes and do not attempt to rewrite them directly unless the user explicitly asks', which acts as a manual review checkpoint.
- [SAFE]: The skill operates entirely within its documented purpose of UX review. No evidence of credential harvesting, remote code execution, obfuscation, or persistence mechanisms was found. All guidelines provided in the reference files are standard UX best practices.
Audit Metadata