code-review
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data, specifically code diffs, pull request descriptions, and comments. This creates an inherent attack surface for indirect prompt injection.
- Ingestion points: The skill instructs the agent to read PR titles, descriptions, linked issues, and diff hunks (Phase 1 and Phase 3).
- Boundary markers: The skill includes a dedicated section ('Untrusted Content') that explicitly warns the agent to treat all diff-related content as evidence to evaluate rather than instructions to obey.
- Capability inventory: The skill is scoped to use 'Read', 'Grep', and 'Bash' tools.
- Sanitization: It instructs the agent to flag any attempts to steer its behavior (e.g., 'ignore your review rubric') as a blocker-level finding.
- [SAFE]: The skill incorporates truth sources and grounding information from trusted organizations and well-known technology services.
- References official engineering practices and documentation from Google, OpenAI, Anthropic, and GitHub.
- Links to author-managed repositories on GitHub for skill project context and metadata verification.
Audit Metadata