deepreview
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard command-line tools to perform code analysis and context gathering. Specifically, it executes
gitcommands for diffing and history,golangci-lintfor Go code,cargo clippyandcargo auditfor Rust, andgitleaksfor detecting sensitive information. In the verification stage, it usesgrep,rg, andast-grepto confirm findings. - [EXTERNAL_DOWNLOADS]: The skill references several well-known and trusted external development tools. It utilizes
npx eslint, which may download theeslintpackage from the official npm registry if not present. It also provides installation instructions for other reputable tools such asgolangci-lintandast-grepfrom their official GitHub repositories. - [PROMPT_INJECTION]: As an automated code review tool, the skill is subject to indirect prompt injection from malicious content within the source code it analyzes. This risk is mitigated by the structured multi-pass review architecture and a verification stage that uses structural analysis (
ast-grep) to confirm findings before they are presented to the user.
Audit Metadata