code-review-excellence
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/pr-analyzer.pyscript utilizes thegitcommand locally to calculate the size and scope of code changes. The implementation uses a structured argument list (subprocess.run(['git', ...])), which is the recommended secure pattern to prevent shell injection vulnerabilities. - [PROMPT_INJECTION]: As a code review skill, it is designed to ingest and process external code and pull request data, which constitutes a surface for indirect prompt injection. 1. Ingestion points: Git diff output and PR descriptions processed in
scripts/pr-analyzer.pyand SKILL.md instructions. 2. Boundary markers: None explicitly enforced within the agent instructions. 3. Capability inventory: Local execution ofgitvia the analyzer script. 4. Sanitization: No explicit instructions for sanitizing code content. This is considered a functional requirement for the skill's purpose, and the skill provides extensive checklists to help reviewers identify such issues in the audited code.
Audit Metadata