review-hog-perspective-contracts-security
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines several ripgrep (rg) commands intended for static analysis of the codebase. These commands search for API endpoints, input validation logic, raw SQL queries, and authentication decorators. These are standard auditing tools and do not involve dynamic execution of untrusted input.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted data from pull requests, which creates a surface for indirect prompt injection. 1. Ingestion points: PR chunks mentioned in the skill instructions. 2. Boundary markers: None specified. 3. Capability inventory: ripgrep (rg) for text searching. 4. Sanitization: None specified. The risk is considered low because the skill's capabilities are limited to search and read operations.
- [SAFE]: The instructions and audit patterns are consistent with the skill's stated purpose as a Contracts & Security review perspective. No obfuscation, data exfiltration, or persistence mechanisms were detected.
Audit Metadata