code-review
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data (source code files, story files, and architectural decision records) and processes it using LLM agents (Phase 1, Phase 3, and Phase 7). This creates a vulnerability surface for indirect prompt injection attacks.
- Ingestion points:
SKILL.mdreads target implementation files, story files, and ADR documents. - Boundary markers: No specific delimiters or safety instructions are defined to separate untrusted data from the agent's instructions.
- Capability inventory: The skill uses
Bashto retrieve git logs andAgentto spawn specialist reviewers. - Sanitization: No sanitization or filtering of the ingested content is performed before processing.- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the dynamic execution pattern (
!command) to run a shell command during the skill loading phase. - Evidence:
!"bash "${CLAUDE_SKILL_DIR}/../../hooks/yaml-helper.sh" resolve_config --keys automation" - The command invokes a local helper script to resolve automation configuration keys. This is a functional utility call with no detected sensitive data access or network exfiltration.
Audit Metadata