code-production-process

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill defines a defensive development process that prioritizes security and quality through a multi-agent pipeline (Research, Architect, Implement, Test, Critic, Security).
  • [SAFE]: Includes a dedicated security review stage (Stage 5) that explicitly audits for OWASP Top 10 vulnerabilities, including injection attacks, broken access control, and insecure deserialization.
  • [SAFE]: Implements a robust 'Critic Isolation Rule' in references/critic-isolation.md to prevent prompt injection and anchoring bias. This includes mandatory extraction procedures to strip narrative rationales from implementation code before it is passed to the reviewer.
  • [SAFE]: Enforces strict automated quality gates, requiring zero failures in pytest and mypy --strict before any code is allowed to proceed to the review stages.
  • [SAFE]: Provides automated checks (via grep) to detect and forbid dangerous execution patterns such as eval(), exec(), and shell=True in subprocess calls.
  • [SAFE]: All external resource references, such as the GitHub repository link, point to the vendor's own infrastructure (bobmatnyc) and show no signs of typosquattng or impersonation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 04:19 PM
Security Audit — agent-trust-hub — code-production-process