bro-review-code
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external code, diffs, and pull requests. This untrusted data is interpolated into prompts for specialized subagents, creating a vulnerability where malicious instructions in code comments could influence agent behavior.
- Ingestion points: The skill reads the repository history, diffs, and PR content as described in
SKILL.mdand passes them to subagents. - Boundary markers: The subagent prompt templates (e.g.,
correctness-review-prompt.md,security-review-prompt.md) use simple placeholders like<review context>without explicit delimiters or instructions to ignore embedded commands in the analyzed code. - Capability inventory: The agent has tool-based read access to the local file system and repository history.
- Sanitization: No input sanitization or escaping of the code data is implemented before it is processed by the LLM.
- [METADATA_POISONING]: The
references/subagent-model-tiers.mdfile provides deceptive information by listing non-existent and speculative AI models (such asgpt-5.5,gpt-5.6-sol,grok-4.6, andclaude-fable-5.1) as target execution environments for its subagents.
Audit Metadata