polish-new
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from a repository (via
git diffand file reads) to drive its review and fix cycles, creating a vulnerability surface for malicious instructions embedded in the reviewed code. - Ingestion points: The skill reads the repository filesystem and
git diffoutput during Phase 2 (Map) and Phase 3 (Find) to provide context to specialized review agents. - Boundary markers: The instructions do not specify the use of strict delimiters or escaping for the ingested code snippets to prevent the agent from accidentally interpreting data as instructions.
- Capability inventory: The skill has significant local capabilities, including executing shell commands (
git,pnpm,cargo), executing arbitrary reproduction commands provided in agent reports (Phase 4), and writing directly to the filesystem to apply code fixes (Phase 6). - Sanitization: There is no explicit sanitization or validation logic for the commands generated by the sub-agents before they are executed in the validation phase.
- [COMMAND_EXECUTION]: The skill relies on executing various shell commands to perform its core functions.
- Orientation and Diffing: Uses
git rev-parse,git status,git diff, andgit showto establish repository state. - Project Checks: Phase 1 executes project-defined validation commands such as
pnpm check,cargo clippy, orruff checkbased on the project's own instructions. - Validation and Fixing: Phase 4 (Validate) instructs the agent to "run the command it cites" from reports to reproduce findings, and Phase 6 (Fix) executes commands to apply and verify changes.
Audit Metadata