mo-review-orca
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external Git candidate SHAs, project backlogs, and feature specifications. This creates a surface for indirect prompt injection where malicious instructions within the reviewed code could attempt to manipulate the agent's logic or reporting.
- Ingestion points: Candidate source code at specific SHAs, docs/backlog.md, and feature specifications in docs/specifications/.
- Boundary markers: The review brief uses explicit grounding and citations. The skill enforces a strict structural format for reports (Review-Execution, Verdict, Counts) and uses mo-review-report.mjs for AST-based validation.
- Capability inventory: The skill executes git, orca, gh, and glab CLI tools for repository management, task orchestration, and issue reporting. It also runs local Node.js scripts for logic processing.
- Sanitization: The issue-routing.md protocol includes a redaction policy for sensitive information before external reporting. The mo-harness-screen.mjs utility classifies terminal output to prevent task injection into unsafe prompts.
- [COMMAND_EXECUTION]: The skill orchestrates tasks by executing system commands including git, orca, gh, and glab. These operations are guided by internal protocols to minimize risk, such as using umask 077 for temporary files and performing read-only realpath checks on workspace paths.
- [EXTERNAL_DOWNLOADS]: The skill interacts with external repository hosting services (GitHub and GitLab) via gh and glab for issue tracking and git fetch for retrieving source code. These interactions target well-known services and are core to the skill's review functionality.
Audit Metadata