code-review
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute git commands using a user-supplied 'fixed point' (branch name or commit SHA). If the underlying execution environment does not properly sanitize shell characters, a malicious user could attempt command injection by providing a crafted reference string.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository, including commit messages, code diffs, and spec files, which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Commit messages retrieved via git log, code changes from git diff, and spec files located in docs/, specs/, or .scratch/.
- Boundary markers: The instructions do not specify the use of clear delimiters or markers to isolate the untrusted data from the agent's core instructions when passing them to sub-agents.
- Capability inventory: The agent utilizes the git command-line tool and spawns subagents to perform the analysis.
- Sanitization: No explicit sanitization or filtering of the retrieved text is described before the content is processed by the agent.
Audit Metadata