requesting-code-review
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes git commands (
git rev-parse,git diff,git show,git log) to extract change information and usesgit worktreein the/tmpdirectory for isolated reviews. These are standard operations for its stated purpose.- [INDIRECT_PROMPT_INJECTION]: The template incode-reviewer.mdexposes an injection surface by embedding external data into the subagent's instruction set. - Ingestion points: The skill ingests user-supplied summaries, requirement documents, and the source code diffs themselves.
- Boundary markers: The instructions lack formal delimiters or escaping to prevent the subagent from interpreting embedded content as commands.
- Capability inventory: The subagent maintains the ability to execute shell-based git tools, providing a path for potential abuse if instructions are successfully injected.
- Sanitization: No input validation or filtering is applied to the SHAs or plan text before they are placed into shell command templates.
Audit Metadata