ponytail-review
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of prompt instructions intended to guide code simplification and review. It does not include any executable code or requests for restricted system tools.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a process for analyzing external data such as code diffs and project requirements, which presents a surface for indirect prompt injection.
- Ingestion points: Code diffs and contract/ticket documents provided by the user as described in SKILL.md.
- Boundary markers: The skill instructs the agent to use project documentation to distinguish between required and speculative code, but does not define specific character-based delimiters for the untrusted content.
- Capability inventory: The skill is restricted to generating text output; it has no file-system, network, or command-line capabilities defined in its frontmatter or body.
- Sanitization: No explicit sanitization or escaping of the user-provided content is mentioned, which is common for purely text-based review skills.
Audit Metadata