should-flag-change
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its primary function involves processing untrusted external data (git diffs and pull request descriptions) to provide recommendations.
- Ingestion points: Analysis of git diff blocks and user-provided descriptions as described in the workflow section of SKILL.md.
- Boundary markers: Uses
<git_diff>tags to delimit untrusted input from general instructions. - Capability inventory: Employs
Read,Grep, andGlobtools to explore the local repository; functionality is limited to advisory output via therecommend-flagtool. - Sanitization: There is no evidence of explicit content validation or sanitization to prevent instructions embedded within the diffs from influencing agent behavior.
Audit Metadata