interrogate
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes local file content and git diffs, which are untrusted data sources that can be manipulated by an attacker. Malicious instructions embedded in the code under review could potentially influence the reviewer models into ignoring flaws or providing biased feedback.
- Ingestion points: The skill reads local file contents and the output of
git diffcommands to prepare the review context in Step 1. - Boundary markers: The
reviewer-prompt.mdtemplate uses simple{DIFF_OR_FILES}and{INTENT}placeholders. While it includes some instructional context, it lacks robust delimiters or escaping to strictly isolate the untrusted code content from the agent's instructions. - Capability inventory: The skill uses the
Tasktool to spawn multiple subagents (LLM models) and provides them with the potentially poisoned content. - Sanitization: There is no evidence of sanitization, filtering, or escaping of the code content before it is interpolated into the reviewer prompts.
Audit Metadata