skills/sirn/dotfiles/code-quality/Gen Agent Trust Hub

code-quality

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes jj (Jujutsu) CLI commands to retrieve file differences and identify code for analysis. Evidence: jj diff -s and jj diff -- path in SKILL.md and SUBAGENT.md.
  • [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes untrusted file content and passes it to sub-agents. 1. Ingestion points: Local files identified via jj or user-specified paths. 2. Boundary markers: Not present; instructions directly interpolate file content (e.g., {files}) into agent prompts without delimiters. 3. Capability inventory: Command execution (jj), spawning of specialized agents (quality-reviewer, security-researcher, etc.), and invocation of external skills (code-test, code-lint). 4. Sanitization: No sanitization or validation of the ingested code content is performed before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 01:08 AM