code-review-ai-ai-review
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill includes code snippets and workflow configurations that execute external CLI tools via
subprocess.runandsubprocess.check_output. These includesonar-scanner,semgrep, andtrufflehog. While these are standard for code analysis, they involve spawning shell processes based on external repository metadata. - [INDIRECT_PROMPT_INJECTION]: The skill has a significant attack surface for indirect prompt injection.
- Ingestion points: The skill reads pull request diffs and descriptions (
diff,pr_description) and passes them directly to an LLM prompt. - Boundary markers: The prompt uses markdown headers (e.g.,
**Diff:**) as separators, but lacks explicit instructions for the model to ignore any instructions or commands embedded within the code diff itself. - Capability inventory: The associated scripts have the capability to execute shell commands and write data back to GitHub pull requests using the
GITHUB_TOKENsecret. - Sanitization: There is no evidence of sanitization or character escaping for the code diffs before they are interpolated into the prompt template.
- [METADATA_POISONING]: The skill description and model selection section reference non-existent or unreleased model versions such as "GPT-5", "Claude 4.5 Sonnet", and "Claude 3.7 Sonnet". This provides misleading metadata regarding the skill's execution environment and capabilities.
Audit Metadata