performance-testing-review-ai-review
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, specifically pull request diffs and descriptions, which serves as a significant attack surface.
- Ingestion points: Untrusted content enters the agent's context via the
$ARGUMENTSparameter and variables likecode_diffandpr_descriptionwhich are interpolated directly into prompts in theSKILL.mdtemplates. - Boundary markers: The provided prompt templates lack robust delimiters (such as XML-style tags) or explicit instructions for the AI to ignore embedded commands within the code being reviewed.
- Capability inventory: The system described in the skill possesses broad capabilities, including executing subprocesses for static analysis, interacting with the GitHub API to post comments, and performing network requests to LLM providers.
- Sanitization: The provided Python and TypeScript examples do not include sanitization, validation, or escaping logic for the diff data before it is sent to the language model.
Audit Metadata