correct
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze untrusted data sources from within the repository's history to identify recurring issues. This input surface could be exploited if an attacker embeds malicious instructions in commit messages or pull request comments.
- Ingestion points: The agent is directed to read "recent commits, reverts, review comments, agent instruction files, and comments that explain workarounds" as specified in
SKILL.md. - Boundary markers: The instructions do not specify any delimiters or safety boundaries to distinguish between the content being analyzed and the agent's internal logic.
- Capability inventory: The agent has the authority to modify repository architecture, update CI/lint configurations, and alter tests across the codebase.
- Sanitization: There are no requirements for the agent to sanitize or validate the external text before using it to determine how to modify the repository.
Audit Metadata