code-review
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from
git diffoutputs and external specification files during the review process. Malicious content within these files could potentially influence the sub-agents' review logic.\n - Ingestion points:
git diffoutput (Step 1) and contents of specification files (Step 2).\n - Boundary markers: The skill does not define explicit delimiters or instructions to the sub-agents to ignore instructions embedded within the data.\n
- Capability inventory: The skill is limited to read-only operations via Git and local file reading.\n
- Sanitization: No sanitization or validation of the ingested diff or spec content is described.\n- [COMMAND_EXECUTION]: The skill constructs and executes shell commands (
git rev-parse,git diff,git log) using input provided by the user for the "fixed point". If the underlying agent implementation does not safely handle shell arguments, this could be exploited for command injection if the user provides a malicious string containing shell metacharacters.
Audit Metadata