review-observability
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill analyzes untrusted data from the user's repository which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: In SKILL.md Step 3, the skill reads source files (Go, TypeScript, Python, etc.), observability configuration files (Prometheus, OpenTelemetry), and git/GitHub diffs.
- Boundary markers: No explicit delimiters or instructions are provided to the subagent to distinguish between the code being analyzed and the analysis instructions in the prompt.
- Capability inventory: The skill executes shell commands (git, gh, grep), writes to the filesystem (.reviews/ directory), and launches subagents as described in SKILL.md Steps 4 and 5.
- Sanitization: No sanitization or filtering is performed on the codebase content before it is passed to the subagent for analysis.
- [COMMAND_EXECUTION]: The skill executes various shell commands (git diff, gh pr diff, grep, date, mkdir) using parameters derived from user input (PR numbers, base refs) or repository state. While these are standard operations for a developer tool, they represent a potential surface for command injection if input is not properly handled by the execution environment.
Audit Metadata