requesting-code-review
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface by incorporating untrusted data from the repository into a subagent's execution context without isolation or sanitization.
- Ingestion points: The
code-reviewer.mdtemplate ingests untrusted content via the[PLAN_OR_REQUIREMENTS]placeholder and the output of git commands (git diff,git show). - Boundary markers: The template uses structural markdown headers but lacks explicit delimiters or specific instructions for the subagent to ignore commands or instructions embedded within the data it is reviewing.
- Capability inventory: The subagent has the ability to execute git commands (
git diff,git show,git log,git worktree) and read file system contents. - Sanitization: No validation, escaping, or filtering is performed on the data fetched from the git repository before it is interpolated into the prompt.
Audit Metadata