review
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources and presents it to a subagent for processing. * Ingestion points: Data is collected from GitHub Pull Request diffs (gh pr diff), Issue descriptions (gh pr view), and local documentation files (plan.md, report.md) in Step 2 and 3. * Boundary markers: The prompt provided to the subagent in Step 4-A lacks explicit delimiters and instructions to ignore commands embedded within the diff or context files. * Capability inventory: The subagent is equipped with Read, Grep, and Write tools, which could be misused if the subagent obeys instructions hidden in the PR diff. * Sanitization: There is no evidence of sanitization or escaping of the ingested content before it is passed to the subagent context.
- [COMMAND_EXECUTION]: The skill instructs the agent to run shell commands (gh, git, mkdir) using parameters derived from $ARGUMENTS. While these tools are standard for development, there is a potential risk of command injection if the agent does not properly validate or escape these inputs before execution.
Audit Metadata