review-all
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a user-provided argument (
$ARG_BASE) in a shell script without sanitization. A malicious user could provide a crafted branch name (e.g., 'main; malicious_command') to execute arbitrary code within the agent's environment. - Evidence: In
SKILL.md,base="$ARG_BASE"is directly interpolated into git commands and passed to the sub-agent task prompts. - [PROMPT_INJECTION]: The skill processes git diffs, which are untrusted external data. This creates a surface for indirect prompt injection where instructions hidden in the code being reviewed could manipulate the agents' evaluation.
- Ingestion points: Git diff output from
git diff <base>...HEADinSKILL.md. - Boundary markers: Present as instructional context for sub-agents, but lacking secure delimiters for the diff data.
- Capability inventory: Execution of git commands and spawning of additional agents based on the diff content.
- Sanitization: No validation or sanitization of the diff content is performed before processing.
Audit Metadata