interrogate
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted data from the repository and interpolates it into prompts for subagents.\n
- Ingestion points: Source code, git diffs, and commit messages are gathered in SKILL.md (Step 1) and passed to subagents.\n
- Boundary markers: references/reviewer-prompt.md uses markdown headers to separate the author's intent and the code diff, but lacks robust delimiters or explicit instructions for the models to ignore instructions embedded within the processed code.\n
- Capability inventory: The skill has the ability to execute shell commands (git diff) and spawn multiple subagents via API calls.\n
- Sanitization: There is no evidence of sanitization or escaping of the user-provided content before it is included in the subagent prompts.\n- [COMMAND_EXECUTION]: The skill instructs the agent to perform shell operations that may be influenced by external input.\n
- Evidence: SKILL.md (Step 1) directs the agent to run git diff main...HEAD or use an 'appropriate base branch'.\n
- Risk: If the base branch name or specific file paths are sourced from untrusted user messages without validation, it could lead to command injection, although the impact is mitigated by the agent's internal tool constraints.
Audit Metadata