review-system-design
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data such as code diffs and design specifications.
- Ingestion points: The agent reads 'a diff, a spec, or both' to construct a dependency tree (SKILL.md).
- Boundary markers: There are no explicit instructions or delimiters defined to prevent the agent from following instructions that might be embedded within the processed diffs or specs.
- Capability inventory: The skill can invoke sub-agents to establish facts and has the capability to 'apply the amendments' (file-write operations) to the codebase (SKILL.md).
- Sanitization: No sanitization or input validation for the external content is specified.
- Mitigation: The workflow explicitly requires a human reviewer to verify findings and confirm fixes before any changes are applied, which serves as a critical security control.
Audit Metadata