workflows-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of code changes, diffs, and pull request metadata, which introduces a potential attack surface for indirect prompt injection.
- Ingestion points: The agent is instructed to read working-tree changes, commit history, and GitHub metadata through the gh tool.
- Boundary markers: Instructions mandate that the agent must cite specific code lines and verify every candidate finding against the current implementation, which anchors the analysis in the source code context.
- Capability inventory: The skill utilizes file read access, invokes specialist agent sub-tasks, and can write to project tracking files like prd.json or file-todos if explicitly requested.
- Sanitization: The workflow includes a synthesis phase where a lead reviewer must deduplicate and verify findings, serving as a process-level validation to prevent external content from misdirecting the agent's conclusions.
Audit Metadata