Code Review
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from source files, directories, and pull request URLs, which creates a surface for indirect prompt injection attacks where malicious code could attempt to influence the agent's behavior.
- Ingestion points: The workflow in
SKILL.mdidentifies file paths, directory paths, and pull request URLs as primary inputs. - Boundary markers: The instructions do not explicitly require the use of delimiters (e.g., XML tags or unique markers) or 'ignore' commands when the agent reads the external content to prevent it from following instructions embedded in the code.
- Capability inventory: While the skill body is declarative, the execution requires the agent to have file-system access (read) and network-access capabilities to fetch pull requests.
- Sanitization: There are no instructions for sanitizing or escaping the content of files or diffs before they are processed by the agent's reasoning engine.
Audit Metadata