ultra-review
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local script (
scripts/create_ultra_review_report.py) to generate a standardized bug report scaffold. The script utilizes a slugify function to sanitize user-provided review names, preventing path traversal vulnerabilities during file creation. It restricts all file operations to a dedicated documentation directory within the workspace. - [PROMPT_INJECTION]: The skill's primary function involves analyzing untrusted source code and external briefs, which presents a surface for indirect prompt injection. Malicious instructions embedded in reviewed files could attempt to influence agent reasoning. The skill mitigates this through explicit configuration and instructional constraints.
- Ingestion points: Reads repository source code and a provided 'review brief' document.
- Boundary markers: Isolates review tasks using assigned concern IDs and specific scope definitions to maintain context boundaries.
- Capability inventory: The agent is restricted to read-only file access and the execution of the reporting script. Frontmatter configuration (
disable-model-invocation: true) and markdown instructions explicitly forbid mutating files, running builds, or executing shell commands. - Sanitization: Relies on strict protocol enforcement that requires static inspection only, ensuring the agent does not execute code found within the untrusted ingestion surface.
Audit Metadata