pair-with-me
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through its automated code review mechanism.
- Ingestion points: The agent reads untrusted content from the repository via
git diffoutput inSKILL.md. - Boundary markers: The prompt template used to spawn the
haikusubagent lacks delimiters or explicit instructions to ignore commands embedded within the code changes. - Capability inventory: The agent possesses the ability to execute shell commands (git and test runners) and manage subagent lifecycles.
- Sanitization: There is no evidence of sanitization or filtering of the repository content before it is processed by the model.
- [COMMAND_EXECUTION]: The instructions require the agent to execute multiple shell commands, including
git diffandgit diff --stat. Furthermore, the agent is directed to "Run the full test suite" at several points in the workflow. While these are standard development activities, they involve the execution of arbitrary code defined within the files of the user's repository.
Audit Metadata