code-review
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from the repository (git diffs, commit logs, and specification files) and passes it directly to sub-agents for analysis.
- Ingestion points: Untrusted data enters the context through the output of
git diffandgit log(Step 1), and from the contents of files identified as specifications (Step 2), such as those indocs/,specs/, or.scratch/folders. - Boundary markers: The skill does not define explicit delimiters (like triple backticks or custom tags) or safety instructions to wrap this untrusted content when generating prompts for the Standards and Spec sub-agents (Step 4).
- Capability inventory: The sub-agents have the capability to read files and are instructed to generate detailed reports based on the provided content. Malicious code comments or spec lines could potentially trick the agents into providing false positives, ignoring real issues, or leaking information within the review summary.
- Sanitization: There is no evidence of escaping, filtering, or sanitizing the diff or spec content before it is interpolated into the sub-agent instructions.
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (
git diff,git log,git rev-parse) that include a user-provided variable (<fixed-point>). - While the skill includes a validation step in Step 1 (
git rev-parse <fixed-point>), if the agent platform naively interpolates the user input into a shell command, an attacker could potentially execute arbitrary commands by supplying a string containing shell metacharacters (e.g.,;,&,|).
Audit Metadata