delivery-review
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process content from untrusted sources, specifically pull request descriptions, commit histories, code diffs, and external specification documents, which may contain malicious instructions.
- Ingestion points: Reads pull request descriptions, branch content, diff ranges, implementation specifications, ADRs, and repository-specific artifacts (SKILL.md, Establish the target).
- Boundary markers: The instructions do not define clear delimiters or instruct the agent to ignore potentially malicious embedded instructions in the analyzed code or documentation.
- Capability inventory: The skill can execute shell commands (test suites) and perform file system operations (git checkouts) (SKILL.md, Step 4).
- Sanitization: There is no evidence of sanitization or filtering applied to the external content before it is processed by the agent.
- [COMMAND_EXECUTION]: The instructions require the agent to identify and execute the project's test command (SKILL.md, Step 4). This capability is an intended part of the workflow but represents a risk if the test command itself is modified in a malicious pull request to execute arbitrary code or exfiltrate environment variables.
Audit Metadata