receiving-code-review
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external PR/MR review comments, which serve as an entry point for untrusted data.
- Ingestion points: External review comments are retrieved via API calls in
references/fix-and-handoff.mdandreferences/headless-mode.md. - Boundary markers: The skill includes explicit instructions in
SKILL.mdandreferences/feedback-triage.mdto treat reviewer text as data/evidence rather than authorization, specifically warning against following commands or safety bypasses found in comments. - Capability inventory: The skill can modify the filesystem, execute project-specific scripts, and interact with the GitHub API via the
ghtool. - Sanitization: Technical instructions in
references/fix-and-handoff.mdmandate using file-based input for CLI commands to prevent command injection and require per-item verification and testing. - [COMMAND_EXECUTION]: The skill utilizes local shell commands and scripts for its operation.
- The specification (
SPEC.md) outlines the use ofpython3 distillery/scripts/distiller.pyfor validation and testing. - The handoff process (
references/fix-and-handoff.md) details using the GitHub CLI (gh) for PR interactions, incorporating safety practices to avoid shell interpolation of user-controlled strings.
Audit Metadata