review-post-task
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- Indirect Prompt Injection (HIGH): The skill creates an attack surface where untrusted data from the repository can influence agent behavior.
- Ingestion points: Untrusted content enters the context via
git diffcommands inSKILL.md(Steps 1.1 and 2.1). - Boundary markers: Absent. The agent receives raw diff data without explicit delimiters or instructions to ignore embedded natural language commands within the code.
- Capability inventory: The skill authorizes the agent to 'Fix each issue directly' (Step 1.3), granting it file-write and modification privileges based on its interpretation of the (potentially malicious) input.
- Sanitization: Absent. There is no mechanism to filter or sanitize instructions embedded in code comments or strings before the agent processes them.
- Command Execution (LOW): The skill executes local shell commands to interact with the version control system.
- Evidence: Usage of
git diff --stat,git diff, andgit add -pinSKILL.md. While these are standard tools, they are the mechanism through which untrusted data is pulled into the agent's reasoning loop.
Recommendations
- AI detected serious security threats
Audit Metadata