requesting-code-review
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [Indirect Prompt Injection] (LOW): The
code-reviewer.mdtemplate interpolates untrusted external data into the agent's instructions without clear delimiters. - Ingestion points: Variable placeholders
{WHAT_WAS_IMPLEMENTED},{PLAN_OR_REQUIREMENTS}, and{DESCRIPTION}incode-reviewer.mdare populated with data that may be sourced from attacker-controlled PR descriptions or external documentation. - Boundary markers: Absent. There are no delimiters (e.g., XML tags or backticks with warnings) to prevent the model from interpreting content inside these variables as instructions.
- Capability inventory: The subagent can execute shell commands (
git diff) and generate reports that influence the main agent's workflow. - Sanitization: Absent. The template assumes the content of these placeholders is purely descriptive.
- [Command Execution] (LOW): The template includes shell commands that use interpolated variables which could be manipulated.
- Evidence: The commands
git diff --stat {BASE_SHA}..{HEAD_SHA}andgit diff {BASE_SHA}..{HEAD_SHA}incode-reviewer.mdrely on the integrity of{BASE_SHA}and{HEAD_SHA}. If an attacker can influence these strings (e.g., via a malicious configuration or PR metadata), they could attempt command injection (e.g.,; malicious_command ;).
Audit Metadata