integrity-review
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of code diffs (hunks), pull request titles, and bodies, which represents a surface for indirect prompt injection.\n
- Ingestion points: The skill reads pull request content and diffs via the
pull_request_contextand file system tools (SKILL.md, SPEC.md).\n - Boundary markers: The instructions explicitly warn the agent to treat instructions in pull request text, commit messages, and comments as data to be reported, rather than instructions to be followed (SKILL.md, SPEC.md).\n
- Capability inventory: The skill is granted access to file system tools including
Read,Grep, andGlob(SKILL.md).\n - Sanitization: The skill relies on behavioral guidelines to identify and report embedded commands as a "Misleading Narrative" or "Reviewer-directed text" finding category.\n- [PROMPT_INJECTION]: The skill contains keywords and phrases typically used in prompt injection attacks within its reference documents.\n
- Evidence: Strings such as "ignore previous instructions" and "do not flag" are present in
references/threat-catalog.mdandSKILL.md.\n - Context: These strings are documented as patterns for the agent to identify and report when found in code changes during an integrity review, rather than being instructions for the agent itself.
Audit Metadata