spec-loop-review-change
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from external sources such as GitHub pull requests, GitLab merge requests, and Git repositories.
- Ingestion points: The skill fetches pull request titles, descriptions, comments, and diffs using
gh(GitHub CLI),glab(GitLab CLI), andgitcommands as specified ingithub-gitlab-evidence-guidance.md. - Boundary markers:
review-core-guidance.mdprovides strong defensive instructions, mandating that the agent treat all external metadata and repository content as evidence rather than instructions. It explicitly prohibits the execution of any scripts, commands, or links found within the reviewed data. - Capability inventory: The skill uses shell execution capabilities for developer tools (
git,gh,glab) and has permission to write review documents to the local file system. - Sanitization: The skill relies on behavioral constraints for the agent to ensure that potentially malicious instructions embedded in PR comments or code diffs are ignored.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to use
git,gh, andglabto collect evidence. It follows security best practices by recommending a temporary directory (/tmp/pi/) for repository checkouts to isolate external code.
Audit Metadata