code-review
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external GitLab merge requests, including code diffs, commit messages, and pull request descriptions.
- Ingestion points: Untrusted content enters the agent context through the
gitlab-mcptool (which fetches merge request details, diffs, and commits) and thepr-code-context.mdfile. - Boundary markers: The instructions do not explicitly require the use of unique delimiters or 'ignore-internal-instructions' warnings when interpolating untrusted data into prompts for the security and quality review steps.
- Capability inventory: The skill has capabilities to write files to the workspace (
pr-code-review-doc.md,pr-code-context.md) and perform write operations to the GitLab API (creating notes and threads) via thegitlab-mcptool. - Sanitization: The skill specifically instructs the agent to redact discovered secrets, tokens, or credentials from any comments posted back to the GitLab merge request.
- [SAFE]: The skill follows security best practices by including a specific section on credential hygiene. It warns against hardcoding GitLab Personal Access Tokens in configuration files and instructs the agent never to echo credentials found in the environment in its output logs or review comments.
Audit Metadata