lzy-review-work
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, including changed files, git diffs, and documentation from the workspace. This content is used to inform the agent's review decisions, creating a vulnerability surface where instructions embedded in the code (such as in comments) could influence the agent's logic.
- Ingestion points: The '审查输入' section explicitly requires '变更文件' (Changed files), 'diff', and '已有名向测试/集成证据' (Existing test/integration evidence).
- Boundary markers: The skill lacks explicit instructions or markers to distinguish between the agent's instructions and the content being reviewed.
- Capability inventory: The skill utilizes
task()calls to delegate to other agents and performs runtime code execution in the QA lane. - Sanitization: There is no evidence of input sanitization or filtering of the content being reviewed.
- [COMMAND_EXECUTION]: The 'Hands-on QA' lane involves executing project code, CLI tools, or APIs to verify implementation behavior. While this is a core functional requirement of the skill, it involves the runtime execution of potentially untrusted code from the local environment.
- Evidence: The 'Lane 选择' table specifies that Hands-on QA is triggered when '行为、CLI、API、UI 或构建产物发生变化' and involves '实际运行最小充分场景' (actually running the minimal sufficient scenario).
Audit Metadata