code-review-expert
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill framework identifies an ingestion surface for untrusted external data via BrowserOS. It includes a capability inventory that allows for command execution via the ExecutionProxy and data persistence via the MemoryStore. The skill proactively instructs the agent to treat these inputs as hostile and to redact sensitive information. Evidence Chain: 1. Ingestion points: Web content and external data via BrowserOS (SKILL.md). 2. Boundary markers: Explicit instructions to treat content as hostile and redact secrets, though structural markers are absent in these instructions. 3. Capability inventory: ExecutionProxy (subprocess commands), MemoryStore (file-writing). 4. Sanitization: Mandatory redaction of secrets/PII before sharing context with subagents.
- [COMMAND_EXECUTION]: The instructions establish a protocol for executing terminal actions using an ExecutionProxy Interface, such as 'rtk npm test'. This is standard and expected functionality for a development-oriented agent within this framework.
Audit Metadata