code-review-checklist
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill is composed entirely of Markdown documentation and guidelines. It contains no executable code, shell scripts, or requests for tool access.
- [INDIRECT_PROMPT_INJECTION]: The skill is intended to process untrusted data (external code provided for review), which is a common surface for indirect prompt injection. However, the risk is negligible as the skill defines no executable capabilities or tool access that could be exploited.
- Ingestion points: External source code provided by the user for review in pull requests or audits (referenced in
SKILL.md). - Boundary markers: Not explicitly defined; the skill relies on the agent's context window.
- Capability inventory: No tools or subprocess capabilities are requested or defined in the skill's frontmatter.
- Sanitization: None; the skill provides guidance for human-like analysis rather than automated execution.
- [CREDENTIALS_UNSAFE]: The skill contains a string formatted as a Stripe live API key (
sk_live_abc123xyz). This is identified as a safe placeholder because it is explicitly labeled as a "Bad" example within a teaching section about security risks. It is used for demonstration purposes and is not a functional credential.
Audit Metadata