review-and-improve
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from the codebase to drive automated code modifications.\n
- Ingestion points: Sections '1. Rules' and '2. Precedents' in
SKILL.mdinstruct the agent to search for and read ADRs, architecture documents, and existing code files throughout the repository.\n - Boundary markers: The instructions do not define boundary markers or include warnings to ignore instructions embedded within the files being read.\n
- Capability inventory: The agent possesses file-writing capabilities to apply fixes and command execution capabilities to run repository checks.\n
- Sanitization: No sanitization or validation of the ingested repository content is performed before it influences the agent's output.\n- [COMMAND_EXECUTION]: The skill instructs the agent to run repository-defined commands, which may execute arbitrary code if the repository configuration is compromised.\n
- Evidence: The 'Fix' section of
SKILL.mdrequires the agent to 'Run the repo's checks (tests, lint, type check) after the fixes,' which involves executing scripts defined in the local environment (e.g., in a package.json or Makefile).\n- [PROMPT_INJECTION]: The instructions explicitly tell the agent to override standard human-in-the-loop interaction patterns.\n - Evidence: The skill states 'The run is unattended: you decide, you proceed, you never wait for an answer' and 'Nobody is there. Print the overview and fix.' This instructs the agent to act autonomously and bypass user review for individual changes.
Audit Metadata