find-bugs
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses git and the GitHub CLI (gh) to collect repository information and retrieve the diff of local changes. These operations are standard developer workflow commands and target well-known services. Evidence: git diff and gh repo view commands in Phase 1 (SKILL.md).
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted code changes. Malicious instructions embedded in the analyzed files could attempt to misdirect the AI's review process. Evidence: 1. Ingestion points: File diffs and individual file reads (SKILL.md). 2. Boundary markers: Absent. 3. Capability inventory: Restricted to auditing and reporting findings. 4. Sanitization: Absent.
Audit Metadata