code-review
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze code diffs, pull request discussions, and ticket descriptions, which constitute untrusted external data that may contain malicious instructions.
- Ingestion points: The
SKILL.mdfile specifies that the agent should inspect "shipped diffs" and derive intent from "named PR, ticket, and their available discussion." - Boundary markers: The skill requires output to be wrapped in "Wave 1 and Wave 2 fences," but it does not specify clear delimiters or "ignore embedded instructions" markers for the untrusted diff content being processed.
- Capability inventory: The skill environment is restricted via
disable-model-invocation: true. Instructions indoctrine.mdandSKILL.mdexplicitly forbid the agent from performing dangerous actions such as writing test files, executing tests (Never invoke /create-test), or making external tracker updates. - Sanitization: The instructions do not mention any sanitization or validation of the code diff content before it is analyzed by the agent.
Audit Metadata