review-fix
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data to drive its core logic, creating an attack surface for indirect prompt injection.
- Ingestion points: Data is ingested from user-provided briefs, Git PR/MR metadata, issue descriptions, and repository-specific documentation in
SKILL.md(Establish the scope contract). - Boundary markers: There are no explicit delimiters or sanitization routines defined to isolate external content from the agent's instructions.
- Capability inventory: The skill possesses significant capabilities, including the ability to apply code edits (repairs) and execute shell commands for testing and linting (Verification Gate) as described in
SKILL.md. - Sanitization: The skill lacks explicit sanitization or filtering of the content retrieved from external forges or PR bodies.
- [COMMAND_EXECUTION]: To verify repairs, the skill executes local scripts such as tests, linters, and type checkers. If a repository contains malicious configuration files (e.g., a poisoned
package.jsontest script orpytestconfig), this execution path could be exploited to run arbitrary code on the local system. - [DYNAMIC_EXECUTION]: The orchestrator dynamically identifies and loads other 'Review Skills' based on the user's input brief. Although it includes a preflight check to ensure these skills are report-only and do not perform mutations, the dynamic resolution of these components based on untrusted text is a potential risk vector.
Audit Metadata