requesting-code-review
Warn
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The subagent prompt template in
code-reviewer.mdconstructs shell commands using placeholders[BASE_SHA]and[HEAD_SHA]. If these commit identifiers contain shell metacharacters (e.g., semicolons or backticks), they could be used to execute unintended commands in the environment where the subagent runs. Evidence:git diff --stat [BASE_SHA]..[HEAD_SHA]andgit diff [BASE_SHA]..[HEAD_SHA]incode-reviewer.md.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which can influence the subagent's behavior. - Ingestion points: The
[DESCRIPTION]and[PLAN_OR_REQUIREMENTS]placeholders incode-reviewer.mdallow arbitrary text injection into the subagent's system prompt. - Boundary markers: Absent. The template relies on standard Markdown headers which do not prevent the subagent from following instructions embedded within the implemented description or plan documents.
- Capability inventory: The subagent is granted access to repository tools including
git diff,git show,git log, andgit worktree add, providing a significant surface for data inspection. - Sanitization: Absent. The skill does not validate or sanitize the input strings before interpolating them into the prompt template.
Audit Metadata