requesting-code-review
Warn
Audited by Gen Agent Trust Hub on Apr 11, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
code-reviewer.mdtemplate executes shell commands using the{BASE_SHA}and{HEAD_SHA}placeholders:git diff --stat {BASE_SHA}..{HEAD_SHA}. If these placeholders are populated with malicious strings containing shell metacharacters (e.g.,; rm -rf /), it could lead to arbitrary command execution on the host system.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests untrusted code data into the agent's context.\n - Ingestion points: The subagent processes external content through the
{WHAT_WAS_IMPLEMENTED},{PLAN_OR_REQUIREMENTS}, and{DESCRIPTION}placeholders, as well as the output of thegit diffcommand (file:code-reviewer.md).\n - Boundary markers: No boundary markers or 'ignore embedded instructions' warnings are present in the subagent template.\n
- Capability inventory: The subagent is capable of executing shell commands (
git).\n - Sanitization: No sanitization, escaping, or validation is performed on the input before interpolation into the prompt or shell commands.
Audit Metadata