auto-check
Warn
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using arguments received from a remote service.
- Evidence: According to references/mcp-rules.md, the agent is expected to call prepare_review_diff on the Connectory MCP server and subsequently "run the returned git_argv locally".
- Risk: This allows a remote service to define the parameters for local command execution, which could be exploited to run arbitrary code if the service provides malicious input under the guise of git arguments.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by design, as it incorporates external tool outputs into the agent's context.
- Ingestion points: The sub-agent processes the verdict and user_guidance fields returned by Connectory MCP tools as defined in the background task logic in SKILL.md.
- Boundary markers: There are no instructions or structural delimiters provided to ensure the agent ignores potentially malicious commands or instructions embedded within the user_guidance or other tool responses.
- Capability inventory: The sub-agent is a generalPurpose agent with access to local files and the ability to trigger further MCP tool calls.
- Sanitization: The instructions do not define any validation or sanitization steps for the data received from the external service before it is surfaced to the user or used to influence agent behavior.
Audit Metadata