bug-injection
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to manage a benchmarking workflow. It creates a temporary directory (
tmp/review-benchmark/), manages a temporary git branch (review-benchmark-tmp), and uses the GitHub CLI (gh) to create issues for reporting results. These operations are restricted to the local workspace and temporary test fixtures. - [DATA_EXPOSURE]: The bug catalog includes a simulated security vulnerability ("BUG-07: Hardcoded API key in source"). This is used as a test fixture to calibrate detection capabilities and does not involve the exfiltration of actual user credentials.
- [SAFE]: The skill's operations are transparent and scoped to automated testing and quality assurance. The activities described align with the stated purpose of benchmarking code review effectiveness.
Audit Metadata