requesting-code-review
Warn
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The template in
code-reviewer.mdincludes shell commands (git diff --stat {BASE_SHA}..{HEAD_SHA}) that directly incorporate unvalidated placeholders. If a malicious user or data source provides a crafted value for{BASE_SHA}or{HEAD_SHA}(e.g., including shell metacharacters like;or&), it could lead to arbitrary command execution on the host system. - [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it processes untrusted data to guide the reviewer subagent's behavior.
- Ingestion points: Untrusted external data enters the agent context via
{WHAT_WAS_IMPLEMENTED},{PLAN_OR_REQUIREMENTS}, and{DESCRIPTION}placeholders incode-reviewer.md. - Boundary markers: The skill lacks delimiters (e.g., XML tags or triple quotes) or explicit instructions for the agent to ignore embedded commands within the provided data.
- Capability inventory: The skill uses subprocess calls to the
gitCLI across bothSKILL.mdandcode-reviewer.md. - Sanitization: No sanitization, escaping, or validation is performed on the input before it is interpolated into the subagent's system prompt.
Audit Metadata