review-security
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a robust library of security patterns and checklists based on verified CVEs and audit reports from major open-source projects. It is designed to enhance an agent's ability to perform security audits rather than execute malicious actions.
- [INDIRECT_PROMPT_INJECTION]: As a code review tool, the skill is inherently designed to ingest untrusted data (diffs and source files). While this creates an attack surface, the skill provides specific instructions for adversarial reasoning and verification to mitigate potential manipulation. This is considered a low-severity risk associated with the primary functionality.
- [SUPPLY_CHAIN_INTEGRITY]: The skill references a local helper script
../../../scripts/review-scope.py. Within the context of a multi-file development skill, this is a standard method for modularizing logic and does not represent a security violation. - [COMMAND_EXECUTION]: The pattern files contain numerous examples of dangerous command execution (e.g.,
subprocess.callwithshell=True) and remote downloads (e.g.,curl | bash). However, these are explicitly labeled as 'Red Flags' or 'BAD' examples for the auditor to identify in target code, not instructions for the skill to execute itself.
Audit Metadata