architecture-review
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted codebase data and passes it to subagents equipped with shell execution capabilities without defined isolation boundaries.
- Ingestion points: Files within the target repository explored during Phase 1 and Phase 2 (SKILL.md).
- Boundary markers: The instructions do not provide delimiters or "ignore previous instructions" warnings to differentiate between the agent's tasks and content found within the target codebase.
- Capability inventory: The skill orchestrates seven parallel subagents that are explicitly permitted to run "read-only shell commands" and execute tooling discovered within the repository, such as bundlers, analyzers, and profilers.
- Sanitization: There is no evidence of filtering, escaping, or validation of the names or outputs of the tools found in the repository before they are executed or incorporated into the agent's context.
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill instructs the agent to identify and execute arbitrary shell commands and build tools provided by the repository being analyzed.
- Evidence: SKILL.md (Phase 2) instructs subagents to "run it and cite the output" for any tooling discovered in Phase 1 (e.g., bundle reports, dependency graphs, or coverage runners). While described as "read-only," the execution of repository-supplied scripts via a shell presents a risk of unintended code execution if the target repository is malicious.
Audit Metadata