claude-code-security-review-action
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads command templates and clones the security review repository from official Anthropic GitHub accounts (github.com/anthropics) to support setup and local development workflows.
- [CREDENTIALS_UNSAFE]: Instructions correctly direct users to store sensitive API keys in GitHub Secrets using standard interpolation patterns (e.g.,
${{ secrets.CLAUDE_API_KEY }}), avoiding hardcoded credentials. - [PROMPT_INJECTION]: The skill identifies an attack surface for indirect prompt injection as it processes pull request content and custom rule files. It proactively includes security hardening guidance, recommending that maintainers require approval for external contributions to mitigate this risk.
- [COMMAND_EXECUTION]: Provides standard command-line instructions for running test suites and evaluation scripts (such as
pytestandpip install) within a local development environment.
Audit Metadata