material-ui-review
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted code diffs from pull requests or branches. This ingestion of external content creates a vulnerability surface for indirect prompt injection attacks where an attacker might embed malicious instructions within the code being reviewed.\n
- Ingestion points: Code diffs are read via
git diffandgit showas defined in the 'Scope' section ofSKILL.md.\n - Boundary markers: The skill provides a 'Subagent scope contract' that explicitly instructs agents to treat input as 'DATA ONLY' and forbids execution or installation of code.\n
- Capability inventory: The agent can read local files, execute
gitandgrep, use theghCLI for network-based GitHub operations, and write to the local filesystem when using the--fixfeature.\n - Sanitization: While the skill uses instructional boundaries, it does not detail specific technical sanitization or filtering of the diff content before processing.\n- [COMMAND_EXECUTION]: The skill executes several command-line tools to perform analysis and reporting.\n
- Evidence: It calls
git diff,git show,grep, and the GitHub CLI (gh) for posting comments and interacting with the GitHub API. These tools are used appropriately for the skill's stated purpose.
Audit Metadata