stage-chapters
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted external repository files and explicitly instructs the agent to follow instructions found within the '=== ADDITIONAL INSTRUCTIONS ===' block. This creates an indirect prompt injection vulnerability surface if a repository contains malicious code comments or instructions.\n
- Ingestion points: The agent reads the text content from '$PREP_FILE' via the Read tool in Step 2.\n
- Boundary markers: Employs '=== ADDITIONAL INSTRUCTIONS ===' and '<author_provided_context>' headers as delimiters.\n
- Capability inventory: The skill utilizes shell execution capabilities to run git and stagereview commands.\n
- Sanitization: It does not sanitize or filter the contents of the additional instructions section before instructing the agent to execute them.\n- [COMMAND_EXECUTION]: The skill runs local CLI tools and shell commands to analyze the repository state and generate review data.\n
- Evidence: Executes 'which stagereview', 'git rev-parse', 'stagereview prep', and 'stagereview show' via shell code blocks.
Audit Metadata