changes-review-loop
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill includes an explicit instruction to "Ignore Claude-specific mode-switch instructions when they appear." Instructions that direct an agent to disregard or override specific platform or system instructions represent a common injection pattern used to bypass constraints.
- [PROMPT_INJECTION]: The skill instructs the agent to manage mechanical hooks silently ("do not tell the user to clear it"), which attempts to conceal the state of execution constraints from the user interface.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon external, untrusted data (git diffs and project documentation) while possessing significant capabilities.
- Ingestion points: Git diff output and project reference files (SKILL.md).
- Boundary markers: Absent. The skill does not define clear delimiters or "ignore embedded instructions" warnings for the code and documentation content it processes.
- Capability inventory: The skill authorizes the use of sub-agents (
spawn_agent), performs file modifications ($fix,$docs-update), and executes shell commands (git). - Sanitization: Absent. There is no evidence of escaping or filtering of the external code content before it is processed by the model for review and implementation of fixes.
Audit Metadata