requesting-code-review
Warn
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The prompt template in
code-reviewer.mdinstructs the subagent to execute shell commands (git diff) using direct interpolation of the{BASE_SHA}and{HEAD_SHA}variables. This pattern is susceptible to command injection if these variables contain shell metacharacters such as semicolons, pipes, or backticks. An attacker could potentially execute arbitrary commands on the system by influencing the commit references or branch names used in the review process. - [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted project data (such as descriptions and requirements) by interpolating them directly into the subagent's system prompt without isolation or sanitization.
- Ingestion points: The
{DESCRIPTION}and{PLAN_REFERENCE}placeholders incode-reviewer.mdare populated with content derived from the development environment, which may include attacker-controlled commit messages or documentation. - Boundary markers: The template lacks protective delimiters (such as XML tags or unique separators) and does not include explicit instructions to the subagent to ignore potentially malicious commands embedded in the interpolated data.
- Capability inventory: The subagent is granted the capability to execute shell commands and read project files via git based on parameters supplied in the prompt.
- Sanitization: No input validation, escaping, or filtering is performed on the strings before they are interpolated into the subagent's instructions.
Audit Metadata