triage
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js and Bun scripts (
next-q.mjsandcold-review.ts) located within its own internalscripts/directory to manage work item metadata and perform context-isolated reviews. - [EXTERNAL_DOWNLOADS]: Standard Node.js dependencies are referenced in
package.jsonand a lockfile, primarily for internal AI SDK components (@earendil-works/pi-ai,@earendil-works/pi-coding-agent) used by the cold review tool. - [DATA_EXFILTRATION]: While the
cold-review.tsscript interacts with AI models, it is designed with a strict mechanical boundary that prevents passing environment variables, stdin, or extra context beyond the specific file being reviewed, effectively limiting data exposure to the intended document.
Audit Metadata