local-adversarial-review-gauntlet
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local binaries including
gitand various review adapters (Codex, Cursor, OpenCode) viasubprocess.Popen. It supports environment variable overrides for binary paths (e.g.,GAUNTLET_GIT_BIN), which is a standard pattern for developer tools requiring integration with locally installed software. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository content and user-provided intent strings, creating a potential surface for indirect prompt injection when these are passed to LLM adapters.
- Ingestion points: Untrusted data is read from the repository filesystem and the
--intentcommand-line argument inscripts/gauntlet.py. - Boundary markers: The
build_promptfunction utilizes explicit section headers to delimit untrusted content from instructions. - Capability inventory: The skill can execute local subprocesses and write results to the local filesystem.
- Sanitization: While strings are interpolated, the skill mitigates risk by using detached checkouts, read-only sandboxes for supported adapters, and strict JSON schema validation on all model outputs.
- [DYNAMIC_EXECUTION]: The supervisor script determines which binaries to invoke at runtime based on configuration and availability. It manages these processes with rigorous wall-clock deadlines and ensures that process groups and their descendants are terminated cleanly to prevent persistent resource usage.
Audit Metadata