review-fix-loop
Pass
Audited by Gen Agent Trust Hub on Apr 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill configures a
Stophook that executes a local shell script ($HOME/.claude/scripts/review-fix-loop-check.sh). This script is used to programmatically determine whether the agent is allowed to exit the loop based on the status of the PR review process. - [PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection (Category 8). It ingests untrusted data and possesses write capabilities.
- Ingestion points: The agent reads the output of
git diffand a tracking document (PR_REVIEW_FIXES.md), both of which can contain content from untrusted code contributors. - Boundary markers: The instructions lack explicit delimiters or system-level instructions to ignore potential commands embedded within the code diffs being reviewed.
- Capability inventory: The skill is authorized to modify files, create git commits, and trigger shell scripts via hooks.
- Sanitization: There is no evidence of sanitization or validation performed on the diff content before it is passed to the reviewer agent or used to guide fixes.
Audit Metadata