manual-review
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of code diffs, creating a surface for indirect prompt injection attacks.
- Ingestion points: The skill is designed to inspect and review external code diffs and worktree changes (SKILL.md).
- Boundary markers: The instructions lack explicit delimiters or specific warnings to ignore instructions embedded within the code being reviewed.
- Capability inventory: The skill has the ability to modify local files, execute tests or linting tools, and perform Git operations like staging and committing (SKILL.md).
- Sanitization: No explicit sanitization or validation of the code content is described.
- Mitigation: This risk is considered negligible and categorized as safe because the skill is explicitly designed with a human-in-the-loop requirement. It disables autonomous model invocation (disable-model-invocation: true) and mandates that no state-changing actions occur without explicit human authorization.
- [SAFE]: The skill follows security best practices for AI agents by ensuring the human remains the final authority for all file system and repository operations. The use of 'allow_implicit_invocation: false' in the agent configuration further prevents accidental or unauthorized use.
Audit Metadata