code-review
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- Indirect Prompt Injection (SAFE): The skill is designed to process untrusted data from external code reviewers, creating a potential surface for indirect injection.
- Ingestion points:
references/code-review-reception.md(processing external reviewer feedback). - Boundary markers: Implements a strict protocol (READ -> UNDERSTAND -> VERIFY -> EVALUATE) and explicit instructions to remain skeptical of external input.
- Capability inventory: Accesses local development tools (git, test runners, build systems) and dispatches subagents via a Task tool.
- Sanitization: Requires verification against the current codebase and technical evidence before any status claims or code changes.
- Command Execution (SAFE): Uses standard shell and git commands (
git rev-parse,grep,awk) to manage context for code reviews. These operations are limited to metadata retrieval and do not involve high-risk administrative actions.
Audit Metadata