review-change
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to process and analyze untrusted external data, which creates a surface for indirect prompt injection attacks where instructions hidden in the data might be interpreted as commands by the agent.
- Ingestion points: As described in SKILL.md (Steps 1 and 2), the skill ingests branch/commit identifiers, patch files, pasted diffs, task briefs, plans, issues, PRDs, and user requests.
- Boundary markers: The skill uses a structured prompt for subagents in Step 4 that utilizes
<lens>placeholders, but it lacks explicit instructions for the subagent to ignore potential natural language instructions embedded within the diff or PRD content. - Capability inventory: The skill instructions include spawning parallel subagents (Step 4) and a
/verification-evidencecommand used to rerun code reproductions (Step 5). These capabilities could be targeted if the ingested content successfully influences the agent's logic. - Sanitization: There is no mention of sanitization, escaping, or filtering of the external content before it is processed by the agent or subagents.
Audit Metadata