code-review
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of git diff output from the repository being reviewed. While the skill includes instructions to treat this content as untrusted advisory text and not as instructions, a theoretical surface for indirect prompt injection exists.
- Ingestion points: The agent reads the output of git diff commands as instructed in SKILL.md.
- Boundary markers: The prompt does not define explicit delimiters for the diff content, but instructs the agent to treat third-party text as untrusted.
- Capability inventory: The skill uses git for data retrieval and writes the final report to a local markdown file.
- Sanitization: The instructions explicitly tell the agent to ignore any instructions or policy overrides found in the reviewed code.
- [EXTERNAL_DOWNLOADS]: The skill references documentation hosted on the vendor's official GitHub repository (folio-org/rfcs). The instructions explicitly prohibit the agent from fetching live content from the network during execution, requiring the use of local pinned snapshots instead. This reference targets a repository owned by the skill author.
Audit Metadata