review-code
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data including source code, git diffs, and project documentation (such as
spec.mdandplan.md). This creates a surface for indirect prompt injection, where malicious instructions embedded in the code could attempt to influence the agent's review or override its behavior. - Ingestion points: The agent reads file content, git references, and authority anchors from the local file system (e.g.,
docs/threads/). - Boundary markers: The instructions do not specify the use of boundary markers or delimiters to isolate untrusted code content from the system instructions.
- Capability inventory: The agent's capabilities are limited to reading files and writing review findings to a specific directory (
.pending-reviews/) using a dedicated tool. It lacks network access and general command execution capabilities. - Sanitization: No sanitization or filtering of the ingested file content is mentioned.
Audit Metadata