skill-staged-review
Warn
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands including git, grep, and gh, as well as custom scripts located in the user's home directory.
- [DATA_EXFILTRATION]: Implementation data, including code diffs and intent contracts, is read from the local system and transmitted to external analysis providers (codex, agy) and posted to GitHub repositories.
- [DYNAMIC_EXECUTION]: The Multi-LLM Quality Review stage uses an orchestration script to dynamically spawn parallel review processes for code analysis using external providers.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as session-intent.md and git diffs which are then passed to LLMs for analysis without sanitization or distinct boundary markers.
- Ingestion points: Reads session-intent.md from the workspace and extracts git diff content for Stage 2 analysis.
- Boundary markers: None identified; input content is interpolated directly into analysis prompts for external providers.
- Capability inventory: Includes file system reads, local command execution, spawning external sub-processes, and network-enabled GitHub comments via CLI.
- Sanitization: No filtering or validation of the ingested content is performed before processing.
- [EXTERNAL_DOWNLOADS]: The skill relies on externally installed tools (gh, codex, agy) and scripts located in ~/.claude-octopus/plugin/ which are not part of the skill's own package and are unverifiable at runtime.
Audit Metadata