impl-peer-review
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several local system commands including git (for diff and log operations) and the compozy execution engine. It also runs a verification command (e.g., make test) which can be user-specified or auto-detected from repository files like Makefile or package.json.
- [DATA_EXFILTRATION]: By design, the skill collects code diffs, project documentation, and commit history to transmit them to external LLM services via the compozy tool. This is required for the external peer-review process.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it incorporates untrusted data from the local repository into the instructions sent to the reviewer.
- Ingestion points: Repository rule files (e.g., CLAUDE.md, .cursorrules), user-provided context files, and the code diff itself are read and interpolated into the prompt template in SKILL.md.
- Boundary markers: The prompt template in references/impl-review-prompt.md uses clearly labeled section headers (e.g., SCOPE, PROJECT RULES, DIFF) to separate data from instructions.
- Capability inventory: The agent can execute git commands, the compozy CLI, and arbitrary verification commands defined in the repository.
- Sanitization: The skill performs format validation on the findings using a bundled script (scripts/validate-findings.sh) but does not sanitize the contents of the ingested repository files.
- [REMOTE_CODE_EXECUTION]: The skill executes a local validation script bundled with its files but does not perform any remote downloads or execution of scripts from external web sources.
Audit Metadata