security-guidance
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes git via subprocess in
scripts/gitutil.pyandscripts/diffstate.pyto identify changed files and content. It explicitly disables git hooks during these calls to prevent execution of untrusted repository scripts. - [EXTERNAL_DOWNLOADS]: In
scripts/ensure_agent_sdk.py, the skill uses pip to install theclaude-agent-sdkfrom the official registry into a managed virtual environment. This is the intended behavior for bootstrapping the agentic reviewer. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted source code into analysis prompts in
scripts/llm.pyandscripts/review_api.py. It includes clear delimiters and boundary instructions to the model to evaluate the data rather than follow instructions within it. 1. Ingestion points:scripts/security_reminder_hook.py. 2. Boundary markers: Present as XML-like delimiters. 3. Capability inventory:gitsubprocess calls and network requests to Anthropic API. 4. Sanitization: Content wrapping in blocks.
Audit Metadata