thermo-nuclear-code-quality-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze external code changes and PR diffs, which creates a potential surface for instructions embedded within code comments or metadata to influence the agent. \n
- Ingestion points: As described in SKILL.md, the agent processes the 'current branch's changes' and PR content. \n
- Boundary markers: The skill does not define specific delimiters to separate the code being reviewed from the agent's instructions, nor does it include warnings to ignore embedded directives. \n
- Capability inventory: The agent is authorized to perform code analysis and write review reports to the filesystem in the /tmp/ directory. \n
- Sanitization: No sanitization or escaping mechanisms are specified for the code content before it is processed by the agent. \n- [SAFE]: The skill directs the agent to store its analysis results in a temporary directory (/tmp/-thermo/). This is standard behavior for reporting tools and aligns with the skill's primary function of providing code reviews.
Audit Metadata