code-production-process
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines a defensive development process that prioritizes security and quality through a multi-agent pipeline (Research, Architect, Implement, Test, Critic, Security).
- [SAFE]: Includes a dedicated security review stage (Stage 5) that explicitly audits for OWASP Top 10 vulnerabilities, including injection attacks, broken access control, and insecure deserialization.
- [SAFE]: Implements a robust 'Critic Isolation Rule' in
references/critic-isolation.mdto prevent prompt injection and anchoring bias. This includes mandatory extraction procedures to strip narrative rationales from implementation code before it is passed to the reviewer. - [SAFE]: Enforces strict automated quality gates, requiring zero failures in
pytestandmypy --strictbefore any code is allowed to proceed to the review stages. - [SAFE]: Provides automated checks (via
grep) to detect and forbid dangerous execution patterns such aseval(),exec(), and shell=True in subprocess calls. - [SAFE]: All external resource references, such as the GitHub repository link, point to the vendor's own infrastructure (bobmatnyc) and show no signs of typosquattng or impersonation.
Audit Metadata