code-review
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute various git commands (
git diff,git log,git status,git rev-parse) to capture the diff and history of the repository for analysis. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from the repository, creating a surface for indirect prompt injection.
- Ingestion points: Commit messages (retrieved via
git log), code diffs (git diff), and specification files found indocs/,specs/, or.scratch/directories. - Boundary markers: The instructions define specific briefs for sub-agents to focus their reports, but do not provide explicit structural delimiters (like XML tags or clear markers) to isolate untrusted repo content from the agent's instructions.
- Capability inventory: The skill possesses file-reading capabilities via git commands and the ability to spawn and instruct sub-agents with potentially poisoned content.
- Sanitization: No explicit sanitization, validation, or escaping of the ingested repository content is performed before it is passed to the sub-agent prompts.
Audit Metadata