qodo-review
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Instructs the agent to execute shell commands using
qodoandgitto perform reviews, check status, and manage project history. - [EXTERNAL_DOWNLOADS]: Directs the agent to install or update the Qodo CLI from official vendor sources, stressing the use of checksum-verified installers to ensure software integrity.
- [INDIRECT_PROMPT_INJECTION]: Ingests and processes untrusted data that could contain malicious instructions designed to influence the AI's review behavior.
- Ingestion points: Processes local git diffs, untrusted files in the working directory, and content from external ticket URLs (e.g., Jira, Linear).
- Boundary markers: Lacks explicit delimiters to differentiate between code data and natural language instructions when passed to the review engine.
- Capability inventory: Performs shell command execution (
git,qodo), network requests to the Qodo API, and writes to the local file system to apply code fixes. - Sanitization: Implements filtering to exclude secrets, binaries, oversized files, and gitignored content from the review diff.
Audit Metadata