requesting-code-review
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The
code-reviewer.mdtemplate exhibits a vulnerability to indirect prompt injection by interpolating potentially untrusted data directly into executable command blocks. - Ingestion points: The template processes data through placeholders including
{BASE_SHA},{HEAD_SHA}, and{DESCRIPTION}. - Boundary markers: The template lacks delimiters or explicit instructions to the agent to treat interpolated data as non-executable content within the shell command block.
- Capability inventory: The subagent is instructed to use the
git diffcommand, which involves subprocess execution. - Sanitization: No validation or escaping mechanisms are implemented to ensure that the interpolated strings do not contain shell metacharacters or malicious commands.
- [COMMAND_EXECUTION]: The reviewer subagent is instructed to execute shell commands (
git diff) using parameters derived from variables that may originate from external sources like pull request metadata, creating a path for arbitrary command execution.
Audit Metadata