execution-grounded-review
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and analyzing content from external sources which may contain adversarial instructions.
- Ingestion points: The skill reads data from code diffs (
git diff), pull request metadata (gh pr view), and scratch files containing the output of various test runners and linters (npm,pytest,cargo,go). This content is provided by the repository and may be controlled by an external author. - Boundary markers: The prompt template used to dispatch the subagent employs explicit section headers (e.g., "Acceptance criteria", "The change under review", "Execution evidence") to separate instructions from data. While this structure helps the model distinguish roles, it does not reliably prevent the model from following instructions embedded within the processed code or logs.
- Capability inventory: The skill is granted access to powerful tools including
Bash(restricted to testing and version control utilities),Read,Glob,Grep, andTodoWrite. A successful prompt injection could potentially influence the use of these tools. - Sanitization: The skill does not perform explicit sanitization, filtering, or escaping of the ingested diffs or log files before they are presented to the analysis agent.
Audit Metadata