code-review
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands like
git diff,git log,git rev-parse, andgh pr viewto retrieve repository context and changes. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection by processing data from sources that can be controlled by external contributors (e.g., commit messages, PR descriptions, and repository files).
- Ingestion points: Reads git diffs, commit history, pull request metadata via GitHub CLI, and repository documentation such as
CONVENTIONS.mdorREADME.mdinSKILL.md(Step 2). - Boundary markers: The prompt instructions for the Conventions and Intent sub-agents do not include explicit delimiters or safety instructions to prevent the sub-agents from obeying commands embedded within the diffs or commit messages.
- Capability inventory: The skill utilizes the
Agenttool to spawn sub-agents which process the untrusted data to generate reports. - Sanitization: There is no evidence of sanitization, filtering, or escaping of the ingested content before it is passed to the sub-agents.
Audit Metadata