finalise
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (local file content and git diffs) and performs sensitive actions (modifying code, pushing to remote repositories) with reduced human oversight.
- Ingestion points: The agent reads untracked files and git diffs during the code review phases (Steps 2 and 5 in SKILL.md).
- Boundary markers: There are no instructions to use delimiters or ignore embedded instructions within the files being reviewed, making the agent susceptible to instructions hidden in code comments or data.
- Capability inventory: The skill can modify files (Step 3), create commits (Step 4), push code to remote branches, and create pull requests (Step 7).
- Sanitization: No sanitization or verification of the ingested code content is performed before the agent 'fixes' findings based on that content.
- Autonomous actions: Step 7 explicitly instructs the agent to bypass confirmation for commit, push, and PR creation operations once the automated review loop completes. This lack of a human-in-the-loop check increases the risk that an indirect prompt injection could result in a malicious PR being opened automatically.
Audit Metadata