review-fix-loop
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes and acts on text output from the codex review tool, creating a surface for indirect prompt injection. 1. Ingestion points: scripts/run_review.py generates and scripts/extract_review_output.py reads the review findings. 2. Boundary markers: No explicit delimiters or isolation markers are used to wrap the ingested review text. 3. Capability inventory: The skill is designed to perform file modifications and execute validation commands via subprocesses. 4. Sanitization: The review text is not sanitized or filtered before being processed by the agent.
- [COMMAND_EXECUTION]: The script scripts/run_review.py executes shell commands for git, gh (GitHub CLI), and codex using subprocess.run. These calls use list-based arguments which effectively prevent standard shell injection attacks.
Audit Metadata