interrogate
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from git diffs or file contents and interpolates it directly into the prompts used to instruct reviewer subagents.
- Ingestion points: Code content identified in Step 1 of
SKILL.mdis passed to the{DIFF_OR_FILES}placeholder in thereferences/reviewer-prompt.mdtemplate. - Boundary markers: The prompt template relies on standard markdown headers but lacks strict isolation boundaries or instructions for the subagents to ignore instructions embedded within the code, which could allow malicious code to manipulate the reviewer's output.
- Capability inventory: Reviewer subagents are configured with
read-onlyaccess and restricted to foreground execution for analysis, which limits the potential impact of an injection to the integrity of the review results rather than system access. - Sanitization: There is no evidence of sanitization, escaping, or schema validation for the code content before it is processed by the subagent models.
Audit Metadata