code-review
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because its core function requires the agent to ingest and analyze untrusted external data, such as pull request descriptions and code, which could contain malicious instructions designed to subvert or mislead the review process.
- Ingestion points: The workflow defined in
SKILL.md(Step 1) explicitly directs the agent to "Read the PR description, issue, tests, API/schema changes, and relevant surrounding code." - Boundary markers: The instructions do not define or utilize explicit delimiters (e.g., XML-like tags or markdown blocks with 'ignore' warnings) to separate the untrusted PR content from the agent's primary instructions.
- Capability inventory: Evaluation fixtures (e.g.,
evals/no-material-findings/prompt.md) confirm the agent is allowed to use file system discovery and reading tools (Read,Glob,Grep) to process the external data. - Sanitization: The skill lacks mechanisms for sanitizing or filtering input to remove or neutralize potential prompt injection patterns within the reviewed artifacts.
Audit Metadata