code-review
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources (PR descriptions and comments), which is a common attack surface for indirect prompt injection.
- Ingestion points: As described in
SKILL.md, the skill processes pull request descriptions, comments, issue text, and code diffs. - Boundary markers: The skill proactively addresses this risk with a
THIRD-PARTY CONTENT DEFENSEhard-gate inSKILL.mdthat explicitly instructs the agent to disregard any embedded instructions or commands. - Capability inventory: The skill is limited to generating structured analysis and text-based reports; it does not define or invoke dangerous system commands, file writes, or network operations.
- Sanitization: The instructions mandate that the agent must ignore directives within third-party text and rely on the code diff as the sole authoritative source of truth.
Audit Metadata