reviewer
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to perform PR-style reviews on code changes, which constitutes processing untrusted external data. This creates a potential surface where malicious instructions embedded in a pull request could influence the agent's behavior.
- Ingestion points: The skill ingests changed behavior boundaries, diff areas, and affected behavior boundaries from code repositories (SKILL.md).
- Boundary markers: There are no explicit delimiters or instructions for the agent to ignore instructions embedded within the code or comments it is reviewing.
- Capability inventory: The skill is instructed to implement or recommend fixes. While the metadata specifies a read-only sandbox, the instructions suggest the agent has the capability to generate code changes based on its analysis.
- Sanitization: The instructions do not define any sanitization or validation logic for the external code content before it is processed by the agent.
- [METADATA_POISONING]: The skill's metadata claims to use a non-existent model version 'gpt-5.4'. While this does not present a direct technical vulnerability, it is deceptive regarding the skill's capabilities and environment.
Audit Metadata