code-review
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, including pull request heads, diffs, linked issues, and review threads. This creates a surface for indirect prompt injection where malicious instructions embedded in a PR could influence the agent's behavior.
- Ingestion points: SKILL.md specifies reading PR head, diffs, linked issues, acceptance criteria, and existing review threads.
- Boundary markers: None explicitly defined to separate instructions from the data being reviewed.
- Capability inventory: Access to read-only GitHub context and CLI/tool schemas.
- Sanitization: No mention of sanitizing or escaping the external content before processing.
- [SAFE]: The skill includes strong safety guidelines, such as prohibiting connections to live user desktops, banning desktop-input tests on shared machines, and restricting modifications to product code or repository settings during reviews. These constraints reduce the operational risk of the agent.
Audit Metadata