repo-review
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted repository content, including source code, pull request metadata, and external findings packages. This creates an attack surface for indirect prompt injection where an attacker could embed malicious instructions within the repository to influence the agent's review verdict or logic.
- Ingestion points: The agent reads content from the local Git worktree, pull request metadata, and structured packages (e.g.,
urn:skills:review-request:v1). - Boundary markers: The instructions do not explicitly mandate the use of delimiters (like triple backticks or XML tags) or safety preambles when interpolating user-controlled content into prompts.
- Capability inventory: The skill's capabilities are strictly read-only, limited to standard Git commands (status, diff, cat-file). It explicitly forbids file modification, staging, committing, and network exfiltration, which significantly limits the impact of potential injections.
- Sanitization: There is no evidence of filtering or sanitization of external content before it enters the agent's context.
Audit Metadata