code-review
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data in the form of repository source code, pull requests, and uncommitted changes.\n
- Ingestion points: Repository content is read into the agent's context during the review planning and execution phases (SKILL.md, Step 1).\n
- Boundary markers: The instructions do not define specific delimiters or provide warnings to ignore instructions embedded within the code being reviewed (e.g., in comments or strings), which could lead the agent to follow malicious directives included in the codebase.\n
- Capability inventory: The skill authorizes the agent to "run the smallest new read-only reproduction once" to validate findings (SKILL.md, Final finding validator instructions). This execution capability, triggered by analysis of untrusted input, creates a vulnerability surface for code execution or context manipulation.\n
- Sanitization: There is no evidence of content sanitization or specific isolation techniques for the untrusted data beyond the instruction to perform "read-only" reproductions.
Audit Metadata