simplify
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of
git diffoutput. This data is passed to sub-agents without clear boundary markers or sanitization, creating a surface for indirect prompt injection. A malicious diff could contain instructions aimed at manipulating the review agents' findings.\n - Ingestion points:
git diffoutput and recently modified files (SKILL.md, Phase 1 and Phase 2).\n - Boundary markers: Absent. The sub-agents are provided the raw diff without delimiters or instructions to ignore embedded commands.\n
- Capability inventory: The skill has subprocess execution capabilities via
git diffand the project's test suite, and file-write access via Phase 3's fix implementation (SKILL.md, Phase 1 and 3).\n - Sanitization: Absent. The skill does not filter or escape the diff content before processing.\n- [COMMAND_EXECUTION]: The skill executes local commands including
git diffand the project's test suite. While these are standard developer tools, they involve executing code within the local environment.
Audit Metadata