review-all
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes git diff output using LLM sub-agents, creating a surface for indirect prompt injection. A malicious actor could include adversarial instructions in code comments within the diff to influence the review results.
- Ingestion points: The output of
git diff <base>...HEADis passed directly into the task prompts for two sub-agents inSKILL.md(Step 3). - Boundary markers: The sub-agent instructions define a specific task and rubric but do not include explicit delimiters or 'ignore embedded instructions' warnings for the diff content itself.
- Capability inventory: Sub-agents are explicitly restricted to a 'review-only' role, forbidden from modifying files, and instructed to output results in a structured JSON format. The main agent manages the workflow and executes git and codex tools.
- Sanitization: No explicit sanitization or filtering of the code diff content is performed before it is processed by the LLMs.
- [COMMAND_EXECUTION]: The skill uses shell commands to resolve branch targets and generate diffs. The
$ARG_BASEvariable, which can be populated by user input, is interpolated into these commands. - The resolution logic in
SKILL.md(Step 1) uses"$base"inside double quotes, which mitigates simple word splitting but relies on the underlying platform's handling of user arguments to prevent command injection if a user provides a base branch name containing shell metacharacters.
Audit Metadata