deep-rules-review
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from Git commits (diffs and blobs) and user-defined rules. These inputs are passed to reviewer sub-agents, creating a surface for indirect prompt injection if the processed content contains malicious instructions intended to manipulate the reviewer's output.
- Ingestion points: Git commit history (baseCommit, targetCommit) and rules from .agents/rules/ (documented in SKILL.md and references/subagent-all-aspects.md).
- Boundary markers: The skill uses strict JSON schemas (schemas/*.schema.json) and content hashing (inputSnapshot, ruleSnapshot) to maintain integrity.
- Capability inventory: Execution of shell commands via node for validation and Git commands for data retrieval.
- Sanitization: The scripts/validate.js tool performs schema validation and hash verification.
- [COMMAND_EXECUTION]: The skill's controller and reviewer logic rely on executing shell commands, specifically node to run internal scripts (scripts/validate.js, skills/rule-steward/scripts/get-rules.mjs) and git for repository interaction.
Audit Metadata