awesome-code-review-jury
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data (source code, diffs, and commit messages) which could contain adversarial instructions designed to influence the AI's review or bypass constraints.
- Ingestion points: The Reviewer subagents ingest arbitrary files,
git diffoutput, and commit messages from the target repository during Phase 3. - Boundary markers: The prompts in
references/briefs.mdinclude explicit instructions for both Reviewers and Judges to treat all repository content as data, ignore embedded commands, and report any detected injection attempts. - Capability inventory: Reviewers are limited to read-only tool access (e.g.,
git show,git log,git diff) and file system reads within the repository scope. They are explicitly forbidden from executing builds, installs, or other state-changing commands. - Sanitization: The Host agent relays reports verbatim between subagents (e.g., providing Reviewer reports to the Judge and Judge questions back to Reviewers). This verbatim relaying creates a pathway where a malicious string in a codebase could theoretically be echoed into a higher-level subagent's context.
Audit Metadata