factory-review
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from Pull Requests, including titles, bodies, comments, and linked tickets, which introduces a potential attack surface for indirect prompt injection.\n
- Ingestion points: As defined in the sub-agent specification, the Review and Fix agents ingest PR metadata, code diffs, and developer instructions (e.g., '@agent fix this').\n
- Boundary markers: The skill does not define technical delimiters for untrusted data but explicitly instructs the agents to treat issue/PR content as untrusted input and prohibits acting on specific commands like merging or handling secrets found within.\n
- Capability inventory: The 'Fix Agent' has the capability to modify the project's source code (
src/is writable) and push those changes to the remote repository.\n - Sanitization: The instructions do not specify a mechanism for sanitizing or escaping the external content before it is interpolated into the agent context.\n- [COMMAND_EXECUTION]: The skill interacts with the host environment to manage code checkouts and repository state.\n
- Evidence: The skill creates isolated, detached git checkouts in specific worktree paths (e.g.,
.adlc/worktrees/factory-review-<sha-short>/) to ensure reviews occur at specific revisions.\n - Evidence: It utilizes standard git commands (
git checkout,git push --force-with-lease) to manage the PR lifecycle, scoped to the current project context.
Audit Metadata