rules-review
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions specify the execution of local Node.js scripts (e.g.,
scripts/validate.js,skills/rule-steward/scripts/get-rules.mjs) and Git operations (git diff,git show) to manage the review lifecycle and validate artifacts. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests untrusted data from project rule files (located in
.agents/rules/) and Git commit content, including code diffs and file blobs. - Boundary markers: The workflow utilizes "strict JSON" artifacts, content snapshots, and independent sub-agent shards (reviewers) to isolate processing, providing structural boundaries.
- Capability inventory: The system possesses the ability to execute shell commands (via Node.js scripts), perform file system operations within the workspace (specifically in the
.rules-review-tmp/directory), and spawn new sub-agent instances. - Sanitization: While the skill enforces rigid structural validation using JSON schemas for its internal artifacts, it does not specify semantic sanitization or filtering to prevent sub-agent reviewers from potentially following malicious instructions embedded within the untrusted code or rule text.
Audit Metadata