code-review
Fail
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: HIGHCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands using a user-provided identifier without explicit sanitization, which can lead to command injection. Evidence: In SKILL.md, step 1 uses a user-supplied '' directly in
git diff <fixed-point>...HEAD,git log <fixed-point>..HEAD --oneline, andgit rev-parse <fixed-point>. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted files from the repository and includes their content in sub-agent prompts, creating a vulnerability surface for indirect prompt injection. Ingestion points: Step 2 and 3 read spec files and coding standards from the repository. Capability inventory: The skill has the ability to execute git commands and read files. Boundary markers: The prompts for sub-agents in Step 4 do not use delimiters or warnings to separate instructions from the ingested repository content. Sanitization: There is no evidence of sanitization or filtering of the file contents before they are passed to the sub-agents.
Recommendations
- AI detected serious security threats
Audit Metadata