review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads data from local files or conversation history and passes it to a review tool. This creates a surface for indirect prompt injection where instructions embedded within the files being reviewed could be executed by the agent when it processes the resulting feedback.
- Ingestion points: The skill uses the
Readtool to ingest file content and also pulls from conversation context (SKILL.md). - Boundary markers: There are no specified delimiters or "ignore instructions" markers used when passing content to the
mcp__interactive_review__start_reviewtool. - Capability inventory: The skill uses file reading (
Read) and a UI interaction tool (mcp__interactive_review__start_review). - Sanitization: The instructions do not include steps to sanitize, filter, or escape the content before it is processed by the agent.
Audit Metadata