self-review
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Data enters the agent context through the
$ARGUMENTSfield inSKILL.md, output from thegit diffcommand, and findings returned by thecritical-reviewersub-agent. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat external input as untrusted or to ignore embedded instructions.
- Capability inventory: The agent is encouraged to execute shell commands (e.g.,
git diff), write to the filesystem (to apply fixes), and spawn new agent processes. - Sanitization: There is no evidence of sanitization or validation of the input before it is used to influence the agent's next actions.
- [COMMAND_EXECUTION]: The skill suggests running
git diff --name-onlyto generate a file list for the reviewer. This is a standard operation within a development environment and does not involve direct injection of user-supplied arguments into the command string.
Audit Metadata