review
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from the repository, creating an attack surface for indirect prompt injection.
- Ingestion points: The skill reads data from 'git diff', 'git log' (commit messages), and documentation files such as 'CLAUDE.md' or files within 'specs/' and 'docs/'.
- Boundary markers: No explicit delimiters or instructions are provided to the agents to distinguish between their operational instructions and the potentially adversarial content within the code diffs or commit messages.
- Capability inventory: The skill's primary capabilities are limited to reading repository data using git; no network access or file-write permissions are requested.
- Sanitization: There is no evidence of sanitization or filtering of the external data before it is presented to the sub-agents.
- [COMMAND_EXECUTION]: The skill performs shell command execution to retrieve the necessary data for its review process.
- Evidence: The skill uses 'git diff ...HEAD' and 'git log ..HEAD --oneline'.
- Context: The variable '' is supplied by the user (SHA, branch, or tag). While these are standard git operations, the interpolation of user-supplied arguments into shell commands represents a potential injection surface depending on the underlying platform's execution safety.
Audit Metadata