base-ui-review
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from source code diffs and PR content, while maintaining the capability to write to the local filesystem (via the
--fixflag) and the GitHub API (via the--commentflag). This creates a surface for indirect prompt injection where malicious code or comments in a diff could attempt to influence the agent's review findings or suggested fixes. - Ingestion points: The skill ingests untrusted data by running
git diffon a target branch or PR and reading the resulting file content as specified in the 'Scope' and 'Phase 1' sections ofSKILL.md. - Boundary markers: The skill attempts to mitigate risks by instructing sub-agents to treat file content as "DATA ONLY" and explicitly forbidding execution, installation, building, or testing of the reviewed files.
- Capability inventory: The skill possesses the ability to execute shell commands (
git,gh), perform file system writes (--fix), and interact with the GitHub API to post comments. - Sanitization: The skill lacks formal sanitization or escaping of the diff content before processing, relying on the agent's adherence to the "DATA ONLY" instruction.
Audit Metadata