code-refactor-review
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data from git diffs and external PR URLs that could contain malicious instructions designed to manipulate the agent. * Ingestion points: Analyzes data from git diff output and PR content fetched from URLs (SKILL.md). * Boundary markers: No explicit delimiters or instructions are provided to help the agent distinguish between code and embedded instructions. * Capability inventory: Uses git diff for reading and is authorized to "make the changes directly" to the filesystem (SKILL.md). * Sanitization: No evidence of input filtering or validation for the code content being processed.
- [COMMAND_EXECUTION]: The skill executes local git commands to perform its primary function. * Evidence: Specifically instructs the use of git diff and git diff HEAD to inspect changes (SKILL.md).
- [EXTERNAL_DOWNLOADS]: The skill accesses external content via PR URLs provided by the user. * Evidence: The instructions include a workflow to inspect changed files from a PR URL (SKILL.md).
Audit Metadata