sherlock-review
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external content such as pull request descriptions, commit messages, and source code changes for its investigative process.
- Ingestion points: Untrusted data from version control systems (PRs, commits) is ingested for deductive reasoning as described in the investigation template (SKILL.md).
- Boundary markers: The skill emphasizes logic and evidence collection but lacks technical delimiters or explicit instructions to ignore potentially malicious instructions embedded in the analyzed PR content.
- Capability inventory: The skill allows the agent to execute 'git diff' and 'npm test', which could be leveraged if a malicious PR contains code or test scripts designed to exploit the test environment (SKILL.md).
- Sanitization: There are no explicit instructions or mechanisms for sanitizing or escaping the content retrieved from external sources before it is processed by the agent.
Audit Metadata