age
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection as it is designed to analyze untrusted code, metadata, and external instructions.
- Ingestion points: The skill ingests untrusted data from diffs, pull request bodies, repository files, and external instruction sources collected via the
review-instructionscommand. - Boundary markers: It uses structured markdown sections and specific finding templates (documented in
references/report-example.md) to isolate external data from internal logic. - Capability inventory: The skill can execute a local Python archive (
age.pyz), manage the lifecycle of sub-agents, and interact with the GitHub CLI (gh). - Sanitization: It implements a multi-stage verification process (documented in
references/fan-out.md) involving subject-specific workers followed by a verifier agent that validates findings against source evidence to mitigate hallucinations or injection-driven false positives. - [COMMAND_EXECUTION]: The skill relies on the local execution of a Python Zip Application (
skills/age/scripts/age.pyz) to perform routing, planning, and report-writing tasks. It also invokes thegh(GitHub) CLI tool for retrieving repository and pull request context.
Audit Metadata