add-review-comment
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: Uses the standard
gh(GitHub CLI) tool to interact with pull requests. The skill instructions use subcommands likegh apiandgh pr viewto post comments and resolve commit SHAs, which is expected behavior for this use case. - [DATA_EXFILTRATION]: Communicates with GitHub's REST API. GitHub is a well-known service, and the operations performed (posting comments) are consistent with the skill's stated purpose. There is no evidence of sensitive data harvesting or unauthorized network connections.
- [SAFE]: The skill implements a form of least-privilege by specifying restricted
allowed-tools(e.g.,gh api:*,gh pr view:*), which limits the agent's execution scope to the necessary GitHub subcommands.
Audit Metadata