review-artifact-comments
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
artifact.mjsexecutes shell commands viachild_process.execFilefor Git operations (e.g.,git remote get-url origin,git rev-parse --show-toplevel,git branch --show-current). Evidence:scripts/artifact.mjsin thegitfunction. - [INDIRECT_PROMPT_INJECTION]: The skill processes artifact files and reviewer comments which are considered untrusted input entering the agent context.
- Ingestion points: Artifact files and their comment blocks are read from the file system (
SKILL.mdStep 2,scripts/artifact.mjsinloadandparsefunctions). - Boundary markers: The skill uses HTML-like comment blocks (
<!-- ork:comments -->) and<comment>tags to delimit instructions and data, which helps mitigate accidental interpretation but doesn't fully prevent malicious content injection. - Capability inventory: The skill has permissions for
Bash,Read,Grep,Glob, andAskUserQuestion, enabling file reads and interaction with the user based on artifact content. - Sanitization: The script performs basic sanitization by restricting specific characters (
<,>, and specific comment tags) in attributes and titles, but it does not sanitize the primary text bodies of comments which the agent reads to decide how to proceed.
Audit Metadata