ecc-cmd-code-review
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data in the form of source code and git metadata for analysis. This creates an indirect prompt injection surface where instructions embedded in the code being reviewed could potentially influence the agent's output or behavior.
- Ingestion points: The skill ingests data from
git diff,git show, PR URLs, and arbitrary file paths as defined in the workflow ofSKILL.md. - Boundary markers: There are no explicit instructions or delimiters defined to help the agent distinguish between the untrusted code content and its own instructional logic.
- Capability inventory: The skill utilizes git tools and file system access to retrieve content for review.
- Sanitization: No sanitization, escaping, or validation logic is present to filter malicious instructions from the analyzed code before it is processed by the agent.
Audit Metadata