flows-app-review
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the GitHub CLI (
gh api) to fetch instructional content and command definitions from the author's repository (cognitedata/dune-app-reviews). - [REMOTE_CODE_EXECUTION]: Instructions direct the agent to retrieve and "follow exactly" the logic and commands defined in a remote file. The content is fetched via API and decoded from Base64 before execution, which allows for dynamic modification of the skill's behavior from an external source.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) due to its core function of auditing untrusted local code.
- Ingestion points: The agent reads React and TypeScript source files from the user's local workspace (
SKILL.md). - Boundary markers: No delimiters or isolation instructions are provided to distinguish between the skill's logic and the content of the files being reviewed.
- Capability inventory: The skill possesses significant capabilities including
Shell,Write,Read,Glob, andGrep, which could be abused if malicious instructions are present in the analyzed source code. - Sanitization: There is no evidence of sanitization or filtering of the local code content before it is processed by the agent.
Audit Metadata