security-guidance
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a security linting tool that detects and prevents the introduction of known anti-patterns into codebase during editing operations.
- [SAFE]: The static analysis flag regarding code injection is a false positive. The mention of
eval()inreferences/pretooluse_hook_canon.mdoccurs within a decision matrix table intended to educate users on risk severity, not within executable code. - [SAFE]: Local state management and debug logging are restricted to the user's local
~/.claude/directory, which is standard for Claude Code plugins and does not involve network exfiltration. - [SAFE]: The skill relies on Python's standard library for its logic, avoiding third-party dependency risks and remote code execution vectors.
- [SAFE]: External references to GitHub and security documentation (OWASP, CWE, NIST) are used appropriately for attribution and educational guidance, originating from established and trusted sources.
Audit Metadata