adversarial-review
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting content from external files, git diffs, and GitHub pull request metadata to be reviewed by an isolated subagent. Malicious instructions embedded within this external content could potentially influence the subagent's behavior.
- Ingestion points: The skill reads data using the
Readtool,git diff, andgh pr viewas specified in Step 3 and the Agentic Optimizations section. - Boundary markers: The prompt template for the isolated reviewer uses simple
<target>delimiters but lacks explicit instructions to ignore or escape any embedded directives within the analyzed content. - Capability inventory: The agent has access to tools including
Read,Glob,Grep,Bash(restricted to git and GitHub CLI), andTodoWrite. - Sanitization: No input validation or sanitization is performed on the ingested data before it is passed to the subagent.
Audit Metadata