adversarial-review
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes branch diffs, commit histories, and pull request descriptions, which are potential vectors for instructions embedded in data.
- Ingestion points: Branch diffs, commit metadata, and local specifications or PR descriptions (SKILL.md).
- Boundary markers: The skill does not explicitly specify delimiters or instructions to ignore embedded commands within the ingested data.
- Capability inventory: The skill has the capability to execute arbitrary commands and repro scripts found during the adversarial phase (SKILL.md).
- Sanitization: No explicit sanitization of input data is mentioned, although the skill enforces execution within isolated temporary worktrees or clones to mitigate impact.
- [COMMAND_EXECUTION]: The skill is designed to execute commands generated by subagents to verify potential failures in the code.
- Evidence: The verification step requires the agent to "Rerun each finding's command yourself against the scoped state" (SKILL.md).
- Mitigation: The skill mandates that adversaries "write repros only inside their own isolated copy" and "must never edit the user's checkout."
Audit Metadata