code-review
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill constructs and executes shell commands using unvalidated user input for git references.
- Evidence: In SKILL.md, instructions specify running
git diff <fixed-point>...HEAD,git log <fixed-point>..HEAD --oneline, andgit rev-parse <fixed-point>using a user-supplied<fixed-point>string. - Risk: Malicious users could attempt command injection by including shell metacharacters in the fixed-point argument.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository being reviewed, potentially influencing sub-agent behavior.
- Ingestion points: Full output of
git diffandgit logcommands, plus contents of specification and standards files indocs/,specs/, and.scratch/directories. - Boundary markers: Absent. Sub-agent prompts lack delimiters or instructions to ignore embedded instructions in the ingested diff or spec files.
- Capability inventory: Parent agent executes
gitcommands and reads various filesystem paths; sub-agents generate summary reports based on potentially attacker-influenced data. - Sanitization: Absent. No validation or filtering is performed on repository data before processing.
Audit Metadata