review-and-refactor
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several Git commands (
git diff,git status,git log) to identify changes since a fixed commit and to manage the local working state during the refactoring process. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests and processes untrusted data from the repository being reviewed.
- Ingestion points: Data enters the agent's context through Git diffs of modified code, project documentation (like
project-documents.mdandAGENTS.md), and external task references. - Boundary markers: The skill instructs agents to distinguish between 'agreed behavior' and 'unresolved proposals,' but it lacks strict structural delimiters to isolate external data from the subagent instructions.
- Capability inventory: The coordinating agent can read filesystem content, execute Git commands, and perform network operations to publish reports to external services using MCP tools or APIs.
- Sanitization: There is no evidence of technical sanitization for injected content; the 'unslop' process defined in
references/unslop.mdis focused on removing AI-specific linguistic patterns rather than security filtering.
Audit Metadata