dual-axis-skill-reviewer
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/run_dual_axis_review.pyutilizessubprocess.runto executepytestoruv run pyteston directories identified as containing skill tests. This execution is a core functional requirement of the tool's review process. The implementation correctly passes arguments as a list, avoiding shell injection vulnerabilities. - [DYNAMIC_EXECUTION]: The test infrastructure in
scripts/tests/conftest.pyusesimportlib.utilto dynamically load the reviewer script for unit testing. This is a standard and acceptable practice for testing standalone Python scripts. - [SAFE]: The script uses
yaml.safe_load()for all YAML parsing tasks, including reading skill frontmatter and index files. This prevents potential remote code execution via unsafe YAML deserialization. - [SAFE]: The skill includes a proactive security feature that scans all target files for hardcoded absolute user paths (e.g., paths starting with
/Users/). This helps developers identify and remediate potential PII leaks before publishing skills.
Audit Metadata