why-what-how-review
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill's process (Step 15 in SKILL.md) explicitly instructs the agent to use 'a throwaway probe script' to confirm suspected problems. This involves the dynamic generation and execution of code at runtime to verify implementation behavior.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process potentially untrusted data from external sources, which could be manipulated to influence the agent's behavior.
- Ingestion points: The agent reads the project's 'REVIEW.md' (Step 1), MR/PR descriptions, linked issues (Step 4), and project-specific documentation (Step 5).
- Boundary markers: The instructions do not specify the use of delimiters or warnings to treat this external content as untrusted data rather than instructions.
- Capability inventory: The skill utilizes 'git' commands for repository access and shell execution for running tests, linters, and probe scripts.
- Sanitization: There are no instructions for sanitizing or escaping the content retrieved from external descriptions or issues before processing.
- [COMMAND_EXECUTION]: The skill uses various 'git' commands (diff, show, log, blame, status, symbolic-ref) and shell commands to perform its review and verification tasks. While standard for a development tool, these represent a powerful capability set that could be abused if the agent is successfully injected.
Audit Metadata