code-review

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze code diffs, pull request discussions, and ticket descriptions, which constitute untrusted external data that may contain malicious instructions.
  • Ingestion points: The SKILL.md file specifies that the agent should inspect "shipped diffs" and derive intent from "named PR, ticket, and their available discussion."
  • Boundary markers: The skill requires output to be wrapped in "Wave 1 and Wave 2 fences," but it does not specify clear delimiters or "ignore embedded instructions" markers for the untrusted diff content being processed.
  • Capability inventory: The skill environment is restricted via disable-model-invocation: true. Instructions in doctrine.md and SKILL.md explicitly forbid the agent from performing dangerous actions such as writing test files, executing tests (Never invoke /create-test), or making external tracker updates.
  • Sanitization: The instructions do not mention any sanitization or validation of the code diff content before it is analyzed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 08:18 PM
Security Audit — agent-trust-hub — code-review