Requesting Code Review
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
code-reviewer.mdtemplate executes shell commands (git diff) using interpolated variables{BASE_SHA}and{HEAD_SHA}. If these variables are populated from untrusted sources (e.g., an attacker-controlled plan file) rather than via the recommendedgit rev-parsecommand, it could lead to arbitrary shell command execution. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted external data within the subagent's prompt without sufficient protection.
- Ingestion points: Untrusted data enters the agent context through the
{WHAT_WAS_IMPLEMENTED}and{PLAN_OR_REQUIREMENTS}placeholders incode-reviewer.md, which are often populated from external files likedeployment-plan.md. - Boundary markers: There are no delimiters (such as triple backticks or XML-like tags) or explicit instructions for the subagent to ignore embedded commands within the provided requirements or implementation descriptions.
- Capability inventory: The skill utilizes shell command execution via the
gitCLI, which could be abused if an injection occurs. - Sanitization: The skill does not perform any sanitization, validation, or escaping of the external content before it is interpolated into the subagent's prompt instructions.
Audit Metadata