code-review
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from repository diffs and issue specifications without adequate boundary markers or sanitization.
- Ingestion points: User-supplied identifiers for the 'fixed point' (branch, commit, or tag), git diff output, commit messages, and external specification files (e.g., in
docs/,specs/, or from an issue tracker). - Boundary markers: The prompts for the 'Standards' and 'Spec' sub-agents do not include delimiters or instructions to ignore potential instructions embedded within the untrusted diff or spec content.
- Capability inventory: The skill uses subprocess calls to
git(rev-parse,diff,log) to process the repository data. - Sanitization: There are no instructions or logic provided to escape or validate the contents of the diff or specification before they are interpolated into the sub-agent contexts.
- [COMMAND_EXECUTION]: The skill directs the agent to construct and execute shell commands using unvalidated user input.
- Evidence: The instruction in
SKILL.mdto "Confirm the fixed point resolves (git rev-parse <fixed-point>)" uses a string provided directly by the user as a shell argument without explicit sanitization requirements.
Audit Metadata