tek-open-review
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git branches (cards, plans, and diffs) that could contain malicious instructions targeting the AI agent.
- Ingestion points: The agent reads data from the
boardfile, specificcardfiles,planfiles, andgit diffoutput from branches namedcard-<id>and a queue branch specified in the project metadata. - Boundary markers: The instructions do not define clear delimiters or instruction-bypass warnings to separate the content being reviewed from the agent's operational instructions.
- Capability inventory: The skill utilizes git read capabilities (diffing, reading file content) and displays results to the user. It explicitly includes safety instructions to not perform write operations like merging or closing cards.
- Sanitization: There is no evidence of sanitization, filtering, or escaping of the content retrieved from the git branches before it is processed by the agent.
Audit Metadata