review-prompt-composer
Pass
Audited by Gen Agent Trust Hub on Sep 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes multiple Git commands (e.g.,
git rev-parse,git diff,git ls-files) via subprocesses inscripts/write_review_prompt.pyto resolve repository state and calculate scope digests. These are used for their intended purpose of inventorying local changes and ensuring the 'freshness' of the review prompt. - [SAFE]: The skill implements a 'Gate sensitive prompt content' step (Category 3 in SKILL.md) and corresponding logic in the Python script to detect and block the inclusion of private keys or credential-bearing URLs in the generated artifacts. It operates strictly on the local working tree and does not perform network operations or exfiltrate data. The use of
subprocess.runis restricted to local Git commands and is non-malicious.
Audit Metadata