code-review
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from git diffs, PR descriptions, and dependency manifest files without explicit boundary markers or sanitization.
- Ingestion points: Untrusted data is ingested from file changes (git diff), GitHub Pull Requests (gh pr diff), and project manifests (package.json, requirements.txt, etc.) during the analysis workflow.
- Boundary markers: The instructions lack explicit delimiters to separate the ingested code content from the agent's instructions, allowing malicious comments in the reviewed code to potentially influence the subagents' review logic or focus.
- Capability inventory: The skill utilizes CLI tools including git, gh, npm, pip, and cargo to perform its tasks, providing a surface for interaction with the external environment based on ingested data.
- Sanitization: There is no evidence of validation or sanitization for data extracted from manifests (such as package names) before it is used in CLI commands (e.g., npm view ), creating a potential surface for command injection via malicious manifest entries.
Audit Metadata