review-package
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple shell commands and a custom bash script (
create-review-zip.sh) to gather files, create a ZIP archive, and interact with the system clipboard viapbcopyandosascript.\n- [DATA_EXFILTRATION]: The scriptcreate-review-zip.shis vulnerable to path traversal. It constructs source paths usingsrc="$PROJECT_ROOT/$file"without validating that the resulting path remains within the project root. This allows files from any accessible location on the file system to be included in the review package if the file list is manipulated.\n- [INDIRECT_PROMPT_INJECTION]: Thereview-package-analyzersubagent processes untrusted project data (source code, README files, and configurations) to determine which files to include in the review package. It lacks boundary markers or sanitization logic to prevent malicious content within these files from influencing its output or the resulting file list.\n - Ingestion points: Reads project configuration files (like
package.json) and source code files identified during reconnaissance inagents/analyzer.md.\n - Boundary markers: None provided in the subagent prompt to separate system instructions from project data.\n
- Capability inventory: The analyzer's output findings directly control the file list used by the packaging shell script in Phase 4 of
SKILL.md.\n - Sanitization: There is no validation or normalization of the file paths generated by the analyzer before they are passed to the
cpcommand in the shell script.
Audit Metadata