why-review-loop

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill instructs the agent to 'Ignore Claude-specific mode-switch instructions' and 'do not tell the user to clear' tool gates, which are attempts to override standard platform behavior and suppress user communication.
  • [PROMPT_INJECTION]: The protocol includes a 'Subagent authorization' clause that purports to grant automatic permission for the agent to use spawn_agent whenever the skill is active, potentially bypassing intended user confirmation checkpoints.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a recursive automation loop that ingests untrusted external data (such as code diffs, specifications, and project plans) and processes it using high-privilege tools. Ingestion points: Target files and artifacts specified by the user for review (e.g., uncommitted working-tree changes, markdown plans). Boundary markers: Absent. The skill does not define delimiters or include instructions for the agent to ignore embedded commands within the reviewed content. Capability inventory: The agent can perform filesystem modifications via $fix, $refine, $spec, and $docs-update, and can execute arbitrary tests via $integration-test. Sanitization: Absent. No validation or filtering is performed on the ingested content before it is used to drive the fix loop.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 03:11 PM
Security Audit — agent-trust-hub — why-review-loop