claude-review
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read local code diffs and file contents to generate review prompts for a sub-agent. This creates an attack surface where malicious instructions embedded in the codebase could attempt to influence the reviewer agent's logic or reporting.
- Ingestion points: Changed file contents and Git diff data read in Step 0 and Step 1.
- Boundary markers: The skill uses 'worktree' isolation to protect the main working copy, though it does not specify explicit structural delimiters to wrap the untrusted code content within the sub-agent's prompt.
- Capability inventory: The sub-agent is granted general-purpose capabilities within the isolated environment via the 'Agent' tool.
- Sanitization: The instructions include explicit guardrails to prevent the inclusion of secrets in prompts and ensure the reviewer cannot mutate code.
- [COMMAND_EXECUTION]: The skill utilizes the 'Bash' tool to execute git commands for resolving the review scope, specifically reading diff summaries and lists of changed files.
Audit Metadata