review
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data via the
$ARGUMENTSvariable, which accepts external inputs like branch names, pull request content, and code diffs. - Ingestion points: The skill explicitly reads
$ARGUMENTSwhich is defined in the frontmatter as branch, PR, diff, or change descriptions. - Boundary markers: The instructions do not include clear delimiters or specific guidance to the agent to treat the implementation data as untrusted, increasing the risk that instructions embedded in the code or PR comments could override the review logic.
- Capability inventory: The skill is intended to be read-only ("independent read-only review", "Don't edit the code"), which significantly limits the potential impact of an injection; however, the agent's broader capabilities could still be targeted.
- Sanitization: There are no instructions for sanitizing or escaping the content of the diffs or PR descriptions before they are analyzed by the agent.
Audit Metadata