codex-fix
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository branch state (diffs and logs), which is then processed by an LLM subagent. This creates a potential surface for indirect prompt injection if the code under review contains adversarial instructions.
- Ingestion points: The skill captures the current branch diff, commit log, and working tree status using git commands in Step 2 of the procedure.
- Boundary markers: No explicit delimiters or 'ignore embedded instructions' warnings are provided when interpolating the diff into the subagent prompt.
- Capability inventory: The skill utilizes the Bash tool for repository interrogation and the Task tool for subagent invocation.
- Sanitization: No sanitization or filtering is applied to the ingested git content before it is passed to the subagent.
- [COMMAND_EXECUTION]: The skill uses the Bash tool to execute standard git commands and filesystem tests. These are used to determine review scope and verify plugin installation, which are routine operations for a development-focused agent skill.
Audit Metadata