recommend-review-reference-architecture
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to process external configuration files and offline evidence, which represents a potential ingestion point for untrusted data. The instructions include a specific mitigation directing the agent to treat this data as inert and ignore any embedded commands or instructions.
- Ingestion points: Relative config paths and offline benchmark evidence (SKILL.md).
- Boundary markers: Present. Explicit instructions to treat imported content as "hostile inert data" (SKILL.md).
- Capability inventory: Execution of a bundled JavaScript file via Node.js (SKILL.md).
- Sanitization: The workflow includes a
validate-configstep and specific stop conditions for blocked or error states. - Local Command Execution: The skill executes a bundled script (
reviewops.mjs) using thenoderuntime. This is the primary mechanism for the skill's functionality and is restricted to the local environment with explicit prohibitions against network access or production write-back.
Audit Metadata