pr-review-canvas
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gh apicalls to fetch PR data, which is the intended purpose of the skill. The commands are standard and restricted to public PR information. - [REMOTE_CODE_EXECUTION]: The skill involves a Python script for assembly, but it is used to combine local template files and escaped JSON data into a single HTML file on the local machine. It does not download or execute remote code from untrusted sources.
- [DATA_EXFILTRATION]: While the skill starts a local web server, it is bound to
127.0.0.1, meaning the interactive dashboard is only accessible to the local user and does not expose data to the internet.
Audit Metadata