agentic-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git diffs and repository files, which could contain malicious instructions designed to influence the review outcome or sub-agent behavior.
- Ingestion points: The skill reads PR diffs, local staged/unstaged changes, and untracked files during the review scope resolution phase (SKILL.md Phase 2).
- Boundary markers: The skill uses structured artifacts (plan, result, manifest) and scoped diff artifacts to isolate data, but lacks explicit instruction-ignore markers for the ingested code content.
- Capability inventory: The skill executes git commands for repository analysis, performs file system writes to the
<docs-dir>/review/directory, and dispatches parallel sub-agent specialists (SKILL.md Phases 4 and 5). - Sanitization: While the skill consolidates and deduplicates findings, there is no mention of sanitizing or escaping the content of the ingested code changes before processing by the agent.
Audit Metadata