requesting-code-review
Pass
Audited by Gen Agent Trust Hub on Mar 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill uses a Task tool template that interpolates untrusted data into a subagent prompt, creating a surface for indirect prompt injection. If an attacker controls the content of the implementation plan or git commit messages, they could influence the subagent's behavior.\n
- Ingestion points: Variable placeholders
{WHAT_WAS_IMPLEMENTED},{PLAN_OR_REQUIREMENTS}, and{DESCRIPTION}in theTasktool template withinSKILL.md.\n - Boundary markers: The template uses Markdown headers and backticks for isolation, but lacks specific instructions for the agent to ignore potentially malicious embedded directives in the data fields.\n
- Capability inventory: The agent has access to
Bash,Read, andTasktools, which could be exploited if an injection succeeds.\n - Sanitization: No input validation, escaping, or filtering of external content is performed before interpolation.\n- [COMMAND_EXECUTION]: The
Tasktool template inSKILL.mdinstructs the agent to run bash commands (git diff {BASE_SHA}..{HEAD_SHA}) using user-supplied parameters. This represents a command injection risk if the{BASE_SHA}or{HEAD_SHA}variables are populated with shell metacharacters (e.g.,;,&&,|).
Audit Metadata