judgment-day
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, including code diffs, PR descriptions, and Jira tickets, to construct prompts for Judge and Fix sub-agents.
- Ingestion points: Target files and PR metadata are read in SKILL.md and interpolated into sub-agent prompts defined in references/prompts-and-formats.md.
- Boundary markers: The prompts use basic headers but lack robust isolation delimiters (such as unique tokens or XML-style tags) to prevent instructions within the processed data from being interpreted as agent directives.
- Capability inventory: The skill has file-writing capabilities through a delegated 'Fix Agent' and suggests support for Git operations like commit and push.
- Sanitization: Input data is not sanitized or escaped before being passed to sub-agents.
- [DYNAMIC_EXECUTION]: The skill dynamically resolves and loads additional instruction files (skills) based on paths computed from a local registry file (.agents/skills/REGISTRY.md).
- Dynamic loading: It selects skill files to load into the agent context at runtime based on the file paths and task type of the target under review.
- Untrusted source: Since the skill is designed to review potentially untrusted code changes, the registry file itself could be modified by an attacker to point to malicious instruction files within the repository.
Audit Metadata