code-review
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts data from git diffs, commit messages, and local documentation files which are then interpolated into sub-agent prompts. This creates an attack surface where malicious content within a pull request or a local specification file could attempt to influence the agent's review logic.\n
- Ingestion points: SKILL.md describes reading from git diff, git log, and files in docs/, specs/, or .scratch/ folders.\n
- Boundary markers: The skill uses parallel execution to isolate context, but lacks explicit delimiters or instructions for sub-agents to ignore embedded instructions in the ingested data.\n
- Capability inventory: File system read access and git command execution across all scripts.\n
- Sanitization: There is no mention of sanitizing the diff or spec content before it is processed by the LLM sub-agents.\n- [COMMAND_EXECUTION]: The skill executes shell-level git commands using input provided by the user.\n
- Evidence: Dynamically constructs git diff ...HEAD, git log ..HEAD --oneline, and git rev-parse based on the user-defined fixed-point variable.
Audit Metadata