requesting-code-review
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: In
code-reviewer.md, the placeholders{BASE_SHA}and{HEAD_SHA}are directly interpolated into shell commands (git diff --stat {BASE_SHA}..{HEAD_SHA}). If these variables are populated with untrusted input containing shell metacharacters, it could lead to arbitrary command execution. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) as it processes untrusted data from code changes and requirement documents.
- Ingestion points: The agent reads the output of
git diffand the contents of files specified in{PLAN_OR_REQUIREMENTS}. - Boundary markers: The prompt template in
code-reviewer.mdlacks explicit delimiters or instructions to ignore embedded commands within the code being reviewed. - Capability inventory: The skill can execute shell commands (
git) and read local files to provide context for the review. - Sanitization: There is no evidence of sanitization or validation for the code content or the git references before they are processed by the agent.
Audit Metadata