review-sweep
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its core workflow of processing untrusted external data (PR review comments) to drive automated code changes.
- Ingestion points: The agent reads and classifies PR review comments to infer broader rules (SKILL.md, Workflow section).
- Boundary markers: The instructions lack explicit boundary markers or warnings to treat review comments as untrusted data that should not override safety protocols.
- Capability inventory: The agent is empowered to automatically apply code changes across the diff based on these inferred rules ("Apply only the clear set automatically", Workflow step 5).
- Sanitization: There is no requirement for the agent to sanitize the inferred rules or validate them against a security policy before applying code modifications.
- Security Risk: A malicious reviewer could provide a comment containing hidden instructions or dangerous code patterns that the agent would then propagate throughout the repository diff.
Audit Metadata