review-loop
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection Surface]: The skill processes user-specified targets (such as code, plans, or diffs) and interpolates their content directly into a subagent's prompt without explicit boundary markers or delimiters.
- Ingestion points: The target content is gathered in Step 1 and passed to the reviewer subagent in Step 2 of
SKILL.md. - Boundary markers: There are no specific delimiters (like XML tags or triple backticks) used to separate the untrusted target content from the reviewer's instructions, nor are there instructions telling the agent to ignore any commands embedded within the target.
- Capability inventory: While the subagent is suggested to be read-only (
Explore), the main agent has the capability to apply fixes (file writes) in Step 4. - Sanitization: The skill does not mention any sanitization or escaping of the target content before interpolation.
- Context: The risk is mitigated by the 'Check Exit Condition' and 'Apply Fixes' steps, which mandate that no changes are applied without explicit user approval.
Audit Metadata