change-review
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing external, untrusted data from git diffs and pull requests, which could contain malicious instructions designed to influence the agent's analysis.
- Ingestion points: Untrusted data enters the agent context through file paths and diff specifications passed to tools like
get_riskandget_change_riskas seen inSKILL.md. - Boundary markers: The instructions do not explicitly require the use of delimiters or "ignore instructions" prompts when the agent handles or transmits the diff content.
- Capability inventory: The skill relies on analytical MCP tools (
get_risk,get_change_risk,get_why,get_health) and standard local CLI tools (git,gh). No high-risk capabilities such as arbitrary file writes or external network exfiltration paths were found. - Sanitization: No sanitization or validation logic for the ingested diff content is specified in the instruction set.
Audit Metadata