ziw-code-review
Pass
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing untrusted content from pull requests, issues, and comments, which could contain malicious instructions designed to hijack the agent's behavior.
- Ingestion points: Untrusted data enters the agent's context through PR bodies, review comments, issue acceptance criteria, and external web content referenced during the review process (found in
SKILL.mdandreferences/hosted-review.md). - Boundary markers: The instructions do not define specific character-based delimiters (like triple backticks or custom markers) for untrusted content. Instead, they provide a strong instructional mandate to treat external evidence as untrusted and ensure it cannot override system instructions or repository configurations (
SKILL.md). - Capability inventory: The skill is authorized to perform network write operations via the GitHub API to submit reviews and to execute shell commands for Git operations and code checks (
SKILL.md,references/github-review-submission.md). - Sanitization: The skill mitigates potential injection risks by explicitly requiring the use of
jqfor JSON serialization and prohibiting the interpolation of review text directly into shell commands, opting for the GitHub CLI's--inputflag instead (references/github-review-submission.md). - [COMMAND_EXECUTION]: The skill utilizes shell commands to interact with Git (e.g.,
git diff,git range-diff) and the GitHub CLI (gh api). It also performs "cheap focused checks" which involve executing commands against the codebase. These actions are necessary for the skill's purpose but involve processing data derived from the code under review.
Audit Metadata