reviewing-llm-integration
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to analyze untrusted code diffs and LLM integration patterns, which creates an inherent surface for indirect prompt injection. A malicious code snippet provided for review could attempt to manipulate the agent's verdict. The skill mitigates this by instructing the agent to adhere to a strict reviewer discipline, use specific structured checklists, and provide "No findings" if code meets security standards.
- [NO_CODE]: The skill consists entirely of Markdown and JSON files containing instructions and examples. It does not include any executable Python, JavaScript, or shell scripts, which eliminates risks associated with runtime code execution or script-based attacks.
- [SAFE]: The skill advocates for security best practices, such as model pinning, input delimitation, and schema validation. Analysis of the skill files revealed no hardcoded credentials, suspicious network calls, or obfuscated content. References to external tools and documentation are limited to well-known security resources and legitimate developer tooling.
Audit Metadata