fix-review-issues
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection (LOW): The skill automatically filters, reconciles, and justifies code review findings by reading content from potentially untrusted project files. An attacker with write access to the repository or shared system paths could use these files to trick the agent into ignoring legitimate issues or executing malicious plans.\n
- Ingestion points: Processes
$reviewoutput and reads local files includingAGENTS.md,plan-*.md,PLAN.md,spec-*.md,SPEC.md, andrequirements*.md.\n - Boundary markers: Lacks explicit instructions or delimiters to isolate ingested data from the core system prompt.\n
- Capability inventory: Orchestrates code modifications via the
$planand$implementtools, providing a path for the injected instructions to influence the codebase.\n - Sanitization: No validation or content sanitization is performed on the ingested files.\n- Command Execution (SAFE): The skill executes
lsandfindto discover configuration and plan files. These operations use hardcoded patterns and are restricted to read-only discovery tasks within the local filesystem and/tmp/directory.
Audit Metadata