adversarial-review
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from implementation code (via git diffs and file reads) and interpolates it directly into a subagent's prompt. This creates a vulnerability surface where malicious content embedded in the code could attempt to override the subagent's review instructions.
- Ingestion points: Implementation changes gathered via
git diffand project configuration files (likeCLAUDE.md) in Step 1 and Step 4. - Boundary markers: The code diff is placed under a standard markdown header in the subagent prompt but lacks robust delimiters or explicit 'ignore embedded instructions' directives to isolate it from the subagent's system prompt.
- Capability inventory: The subagent's findings can result in the main agent automatically modifying files (Step 3: Fix Findings), which could be exploited if the subagent is tricked into recommending malicious changes.
- Sanitization: There is no evidence of sanitization, escaping, or structured parsing of the code content before it is processed by the LLM subagent.
Audit Metadata