review-dispatch
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content such as code diffs and PR metadata, which can contain malicious instructions intended for the AI.
- Ingestion points: Untrusted data is ingested in Step 3 via git diff, gh pr view, and git log.
- Boundary markers: Explicit instructions direct the agent to ignore instructions embedded in reviewed content and treat finding fields as untrusted text.
- Capability inventory: The agent can execute shell commands (git, gh) and file GitHub issues.
- Sanitization: The skill mandates treating all finding fields as untrusted and avoids direct interpolation into shell commands by using file-based inputs for bodies.
- [COMMAND_EXECUTION]: The skill executes shell commands to automate review workflows and issue tracking.
- Evidence: The retrospective mode utilizes gh issue create to file discovered issues.
- Mitigations: The skill requires the agent to present the exact content of any proposed issue to the user for approval before the command is executed.
Audit Metadata