ps-interrogate
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
git diff main...HEADinSKILL.mdto identify the code changes requiring review. This is a standard use of version control tools within a developer-oriented skill. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from feature branches via git diffs, creating a surface for indirect prompt injection where malicious comments in the code could attempt to influence the reviewer models. 1. Ingestion points: The output of
git diffis read inSKILL.md(Step 1) and passed to subagents inreferences/reviewer-prompt.mdvia the{DIFF_OR_FILES}placeholder. 2. Boundary markers: The prompt template inreferences/reviewer-prompt.mdlacks explicit structural delimiters or 'ignore' instructions around the untrusted diff content, although it is contained within a labeled section. 3. Capability inventory: The skill's capabilities are restricted to reading files, spawning subagent reviewers, and synthesizing text findings. The skill explicitly directs the agent 'Do NOT auto-apply changes', which serves as a critical safety barrier. 4. Sanitization: The skill does not perform sanitization or filtering of the diff content before it is analyzed by the subagents.
Audit Metadata