requesting-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The subagent prompt defined in
code-reviewer.mdinterpolates untrusted or external data without adequate safety controls. - Ingestion points: The template uses
{WHAT_WAS_IMPLEMENTED},{PLAN_OR_REQUIREMENTS},{DESCRIPTION}, and{PLAN_REFERENCE}placeholders incode-reviewer.md. - Boundary markers: None are present to delimit untrusted input from the subagent's core instructions.
- Capability inventory: The subagent has the ability to execute shell commands (
git diff) and perform analysis tasks. - Sanitization: No sanitization or validation of the input strings is performed before interpolation.
- [COMMAND_EXECUTION]: The skill instructs the subagent to execute shell commands using potentially untrusted variables.
- Evidence: In
code-reviewer.md, the commandsgit diff --stat {BASE_SHA}..{HEAD_SHA}andgit diff {BASE_SHA}..{HEAD_SHA}are used. - Risk: While the primary
SKILL.mdinstructions show the agent fetching these SHAs viagit rev-parse, the template itself is vulnerable to command injection if the{BASE_SHA}or{HEAD_SHA}variables are supplied with shell metacharacters (e.g.,HEAD; rm -rf /) from a malicious source, such as a crafted commit message or task description.
Audit Metadata