requesting-code-review
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The code-reviewer.md template demonstrates a surface for indirect prompt injection. It ingests several external data points—such as the plan requirements and implementation descriptions—and interpolates them directly into the subagent's core instructions without using boundary markers (like XML tags or triple quotes) or 'ignore' instructions.
- Ingestion points: code-reviewer.md via placeholders {WHAT_WAS_IMPLEMENTED}, {PLAN_OR_REQUIREMENTS}, and {DESCRIPTION}.
- Boundary markers: Absent; inputs are placed directly in the prompt text.
- Capability inventory: The subagent is instructed to execute git diff and provide a production-readiness assessment.
- Sanitization: Absent; the template does not specify any validation or filtering for the interpolated content.
- [COMMAND_EXECUTION]: The code-reviewer.md template contains a shell command block that executes git diff {BASE_SHA}..{HEAD_SHA}. These placeholders represent a command injection vector if they are populated with unvalidated strings containing shell metacharacters (e.g., backticks or semicolons). While typically these would be valid git SHAs, if an attacker can influence the source of these values, they could execute arbitrary commands in the agent's environment.
Audit Metadata