herdr-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill interpolates external data, including repository code, PR descriptions, and user-supplied context, into prompts for a delegated reviewer agent. The absence of explicit boundary markers or sanitization logic creates a surface where malicious instructions embedded in the reviewed code could potentially influence the delegated agent's behavior. * Ingestion points: Repository content, branch/PR metadata, and user-provided context (SKILL.md, Section 4). * Boundary markers: Not explicitly defined in the handoff prompt structure. * Capability inventory: The skill utilizes the 'herdr' CLI for shell command execution, pane management, and agent control. * Sanitization: No specific filtering or escaping mechanisms are described for the external data passed to the child agent.
- [COMMAND_EXECUTION]: The skill relies on the execution of shell commands via the 'herdr' CLI and standard utilities like 'test' to perform environment checks, manage agent lifecycles, and relay reports. While these are core functions of the skill, they represent an active execution capability that could be targeted if the skill's instructions were compromised.
Audit Metadata