review-security
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code from pull requests and local files to perform security reviews, which creates an attack surface where malicious content (such as code comments) could influence the AI agent's analysis.
- Ingestion points: Project files read via the filesystem or retrieved through 'gh pr view' and 'git' commands (SKILL.md, Phase 0 and Phase 3).
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when presenting untrusted code to the model.
- Capability inventory: The skill utilizes shell commands ('gh', 'git') and invokes subagents ('haiku' model) to analyze processed data.
- Sanitization: There are no instructions for sanitizing or escaping external content before interpolation into prompts.
- [COMMAND_EXECUTION]: The skill workflow in SKILL.md (Phase 0) instructs the agent to run shell commands like 'gh pr view' and 'git diff-tree' using arguments provided by the user (PR numbers or commit SHAs) without explicit instructions for input validation or sanitization, which could lead to command injection if malicious arguments are passed.
Audit Metadata