zj-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using
git(e.g.,git diff,git log,git rev-parse). These commands utilize user-provided arguments ('fixed points'), which introduces a potential for command injection if the inputs are not properly validated by the execution environment. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from version control diffs, commit logs, and external specification files, which are then passed to sub-agents.
- Ingestion points:
git diffoutput and project files located indocs/,specs/, and.scratch/(SKILL.md). - Boundary markers: The skill does not provide clear delimiters or negative constraints to prevent sub-agents from interpreting malicious instructions hidden within the diffs or specifications as valid commands.
- Capability inventory: The skill can execute local shell commands via
gitand instantiate new agent contexts (sub-agents). - Sanitization: The instructions do not specify any sanitization, filtering, or encoding for the external data before it is interpolated into prompts for the sub-agents.
Audit Metadata