claude-review
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interacts with the user's environment via the
claudeCLI. It uses shell commands for environment checks (which claude) and analysis execution (claude -p). The skill explicitly mitigates shell injection risks from user-provided text by using heredocs with quoted delimiters (<<'CLAUDE_PROMPT'), which prevents the shell from expanding or executing content within the prompt block. - [PROMPT_INJECTION]: The skill is subject to indirect prompt injection (Category 8) because it analyzes untrusted documentation and code files.
- Ingestion points: User-provided absolute file paths, git repository state (diffs, branches), and inline text descriptions in
SKILL.md. - Boundary markers: The instructions do not define specific boundary markers or instructions to ignore embedded commands within the files being reviewed by the secondary agent (Claude).
- Capability inventory: The skill can execute shell commands and access the filesystem via the
claudeCLI. - Sanitization: Quoting and heredoc delimiters are used for command-line safety; however, no content-level sanitization is applied to the reviewed documents to prevent malicious instructions targeted at the analyzer.
- [SAFE]: The skill enforces a "read-only" constraint, instructing the agent not to modify workspace files or implement prototypes. It also provides clear instructions for handling errors and installation from a well-known service (Anthropic).
Audit Metadata