why-review-loop
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructs the agent to 'Ignore Claude-specific mode-switch instructions' and 'do not tell the user to clear' tool gates, which are attempts to override standard platform behavior and suppress user communication.
- [PROMPT_INJECTION]: The protocol includes a 'Subagent authorization' clause that purports to grant automatic permission for the agent to use
spawn_agentwhenever the skill is active, potentially bypassing intended user confirmation checkpoints. - [INDIRECT_PROMPT_INJECTION]: The skill creates a recursive automation loop that ingests untrusted external data (such as code diffs, specifications, and project plans) and processes it using high-privilege tools. Ingestion points: Target files and artifacts specified by the user for review (e.g., uncommitted working-tree changes, markdown plans). Boundary markers: Absent. The skill does not define delimiters or include instructions for the agent to ignore embedded commands within the reviewed content. Capability inventory: The agent can perform filesystem modifications via
$fix,$refine,$spec, and$docs-update, and can execute arbitrary tests via$integration-test. Sanitization: Absent. No validation or filtering is performed on the ingested content before it is used to drive the fix loop.
Audit Metadata