review-code
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted data which presents a theoretical attack surface for indirect prompt injection.
- Ingestion points: The skill fetches data from git diffs, commit messages, and GitHub issues/PR bodies using the
gitandghtools as described in the 'Scope' and 'Spec axis steps' sections ofSKILL.md. - Boundary markers: The instructions lack explicit boundary markers or instructions to the model to ignore potential commands embedded within the diffs or issues it analyzes.
- Capability inventory: The skill is granted access to
Bash(git *)andBash(gh *). While described as read-only, these tools are used to interact with external data sources. - Sanitization: There is no mention of sanitizing or escaping the content of the diffs or PR metadata before processing.
Audit Metadata