review-loop
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it retrieves findings from external AI reviewers (Codex, Greptile, Devin) via GitHub comments and applies them to the local codebase.\n
- Ingestion points: The skill fetches review comments and bodies using
gh apicalls inSKILL.md.\n - Boundary markers: There are no explicit delimiters or instructions to ignore malicious directives embedded within the fetched comments.\n
- Capability inventory: The skill has the capability to write to the filesystem (applying fixes) and execute git commands (
git commit,git push) inSKILL.md.\n - Sanitization: No formal sanitization is performed on the comment content; the skill relies on the agent's ability to triage findings based on qualitative instructions (e.g., 'lean toward skipping').\n- [DYNAMIC_EXECUTION]: The skill performs dynamic execution by generating and applying code changes based on external reviewer input.\n
- Evidence: In Phase 2, Step D of
SKILL.md, the skill reads code suggestions or textual descriptions from external comments and applies them directly to source files.\n - Evaluation: While this is the core feature of the automated review loop, it represents a vector where external data influences the generation of executable code.\n- [DYNAMIC_CONTEXT_INJECTION]: The skill uses dynamic context injection to gather repository state at load time.\n
- Evidence: The
## Contextsection inSKILL.mdexecutesgit branch,git status,gh pr view, andgit logusing the!syntax.\n - Evaluation: These commands are used for legitimate context gathering to inform the agent's workflow and do not involve sensitive data exfiltration or unauthorized access.
Audit Metadata