review-code
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its primary function is to ingest and analyze untrusted code from external sources (diffs, files, and git references).
- Ingestion points: SKILL.md (Procedure Step 2) instructs the agent to gather and read "The code under review" and associated implementation reports from user-provided paths.
- Boundary markers: The instructions lack requirements for using explicit delimiters or tags to separate the untrusted code content from the system prompt, increasing the risk of instruction confusion.
- Capability inventory: The agent possesses capabilities to read multiple project documentation files (ADRs, PDRs, glossary) and write finding bundles to the .pending-reviews/ directory.
- Sanitization: The instructions do not mandate any form of sanitization or filtering of the code content before processing, which could allow malicious instructions embedded in comments to reach the model.
Audit Metadata