review-code
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes git and gh (GitHub CLI) to fetch diffs and commit data, and executes a bundled Python script (merge_findings.py) via uv run to consolidate the results. It also invokes various auditing tools (like npm audit or pip-audit) when the relevant lanes are triggered, which is consistent with the intended purpose of automated code review.
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it analyzes external, untrusted content from code repositories and pull requests through LLM agents.
- Ingestion points: The skill ingests data from gh pr diff output, commit details via git show, and the contents of various repository files, including source code and AGENTS.md instructions.
- Boundary markers: The prompts do not use robust structural delimiters or sanitization techniques to isolate the reviewed code content from the agents' instructions, which could allow malicious code comments to influence the agents' findings.
- Capability inventory: The skill can perform repository file reads, write output to local scratch directories, and post comments to GitHub pull requests via the API.
- Sanitization: There is no specific evidence of input sanitization or filtering designed to mitigate adversarial prompt injection within the processed code strings, relying instead on the underlying LLM's safety guardrails.
Audit Metadata