change-review-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to 'Discover the available harness, .harness/bin/harness, or source executable' and execute it with various flags. This pattern involves executing binaries found within the local environment or the repository itself, which requires that the repository content and the local 'harness' installation are trusted.
- [INDIRECT_PROMPT_INJECTION]: The skill processes structured reviewer outputs, metadata, and a 'handoff reference' (references/review-handoff.md) to make decisions about code fixes and dispositions.
- Ingestion points: External command output from the 'harness' tool and the contents of the 'review-handoff.md' file are read into the agent's context.
- Boundary markers: The skill uses section headers in the handoff document, but does not specify strict sanitization or 'ignore' instructions for content parsed from the external tool's output.
- Capability inventory: The agent is authorized to run the harness tool, perform git-like operations (determining merge-bases and refs), and make 'material corrections' (file writes) to the codebase.
- Sanitization: There is no explicit mention of sanitizing the tool output or handoff content before it influences the agent's follow-up actions or remediation steps.
Audit Metadata