skill-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git diff outputs. Because the agent has the capability to write to GitHub (using gh pr-comment), a malicious code change could potentially contain instructions that mislead the agent or abuse its GitHub integration. 1. Ingestion points: git diff output in SKILL.md for stub detection and PR identification. 2. Boundary markers: No explicit delimiters identified to separate code content from agent instructions. 3. Capability inventory: gh CLI (comment, list, view), git (diff, rev-parse), and local shell script execution. 4. Sanitization: Employs a safe-gh-comment.sh script to prevent direct interpolation of AI output into shell arguments.
- [EXTERNAL_DOWNLOADS]: The skill relies on and executes shell scripts located in a local plugin directory (~/.claude-octopus/plugin/scripts/). These are external dependencies whose implementation details are not contained within the skill payload.
- [COMMAND_EXECUTION]: The skill utilizes several system commands including git, gh, grep, wc, and tr, as well as custom scripts (orchestrate.sh, agent-registry.sh) to automate the review workflow.
- [PROMPT_INJECTION]: The instructions employ strong imperative language such as 'MANDATORY COMPLIANCE', 'PROHIBITED', and 'MUST execute' to strictly enforce a specific review persona and multi-provider pipeline, which mimics prompt injection patterns used to override system behavior.
Audit Metadata