fallow-review
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPERSISTENCECOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a persistent file-monitoring pipeline that automatically ingests content from a local file (
.fallow-review/feed.jsonl) and injects it into the agent's active prompt context.\n - Ingestion points: The
hooks/fallow-review-on-feedback.shscript is triggered on file changes to read new lines from the review feed.\n - Boundary markers: The script wraps the injected content with a warning stating that the feedback consists of unverified human notes to be weighed as input, which serves as a weak instructional boundary.\n
- Capability inventory: The skill allows the agent to read repository files, execute git operations, and write structured review data to JSON files on disk.\n
- Sanitization: The ingestion script extracts the
notefield usingjqbut does not perform sanitization or filtering of the string content to remove potential prompt injection markers before context injection.\n- [PERSISTENCE]: The skill relies on registeringSessionStartandFileChangedhooks in the platform configuration (.claude/settings.json), causing the monitoring scripts to be executed automatically whenever the session starts or relevant files are modified.\n- [COMMAND_EXECUTION]: The skill executes local shell scripts (hooks/fallow-review-session-init.shandhooks/fallow-review-on-feedback.sh) to manage the feedback loop and update the agent's context dynamically.
Audit Metadata