code-quality
Pass
Audited by Gen Agent Trust Hub on Mar 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes
jj(Jujutsu) CLI commands to retrieve file differences and identify code for analysis. Evidence:jj diff -sandjj diff -- pathinSKILL.mdandSUBAGENT.md. - [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection because it processes untrusted file content and passes it to sub-agents. 1. Ingestion points: Local files identified via
jjor user-specified paths. 2. Boundary markers: Not present; instructions directly interpolate file content (e.g.,{files}) into agent prompts without delimiters. 3. Capability inventory: Command execution (jj), spawning of specialized agents (quality-reviewer,security-researcher, etc.), and invocation of external skills (code-test,code-lint). 4. Sanitization: No sanitization or validation of the ingested code content is performed before processing.
Audit Metadata