diffity-resolve-tree
Pass
Audited by Gen Agent Trust Hub on May 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the 'diffity' package to be installed globally on the system and provides instructions for the agent to install it via npm if it is missing.- [COMMAND_EXECUTION]: The skill extensively uses the 'diffity' CLI tool to list repository comments, reply to users, and mark threads as resolved.- [PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it is designed to read and follow instructions contained within external code review comments.
- Ingestion points: Data enters the context via the 'diffity agent list' command as specified in SKILL.md.
- Boundary markers: No delimiters or safety instructions are provided to help the agent distinguish between code review feedback and potential malicious instructions.
- Capability inventory: The skill allows the agent to modify any file in the repository (source code and documentation) and execute CLI commands.
- Sanitization: There are no verification steps or sanitization procedures described for handling the comment content before it influences code changes.
Audit Metadata