Skills
Navigate
skills/new-career-begin/queryweaver/code-review-ai-ai-review/Gen Agent Trust Hub

code-review-ai-ai-review

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of pull request diffs (code_diff) and descriptions (pr_description). These inputs are interpolated directly into prompts for high-capability LLMs (Claude 4.5 Sonnet, GPT-5) without explicit boundary markers or instructions to ignore embedded commands. This creates a surface where a malicious PR could attempt to influence the reviewer's verdict or behavior.
  • Ingestion points: code_diff and pr_description variables in ai_review and review_prompt templates.
  • Boundary markers: Absent in the provided prompt templates.
  • Capability inventory: The skill includes scripts that execute shell commands (subprocess.run), perform network requests to GitHub/Anthropic APIs, and write review comments back to repositories.
  • Sanitization: None observed for the interpolated strings.
  • [COMMAND_EXECUTION]: The provided Python orchestrator script uses subprocess.run and subprocess.check_output to execute system commands like sonar-scanner and semgrep. While these are standard tools for the skill's purpose, they represent a significant capability tier.
  • [DATA_EXFILTRATION]: The skill accesses sensitive environment variables (GITHUB_TOKEN, ANTHROPIC_API_KEY, OPENAI_API_KEY) and transmits code content to external LLM providers (Anthropic, OpenAI). This is functionally required for an AI-powered reviewer but constitutes high-sensitivity data handling.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 03:03 PM
Security Audit — agent-trust-hub — code-review-ai-ai-review