quality-scoring
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run various development commands like
npm test,npx tsc, andnpm run build. These commands execute scripts defined in the project's configuration, which is the intended purpose for auditing code but relies on the integrity of the local environment.\n- [PROMPT_INJECTION]: The skill processes external code changes which could contain instructions designed to manipulate the agent's scoring behavior. \n - Ingestion points: Code diffs and changes reviewed in the development loop through files like SKILL.md and references/. \n
- Boundary markers: The instructions emphasize role separation (maker vs checker) and objective evidence, but do not provide formal delimiters or 'ignore' instructions for the code content itself. \n
- Capability inventory: The agent has the ability to execute shell commands (npm, npx), write to the output block, and access file system contents (references and simulation results). \n
- Sanitization: No explicit sanitization or validation of the code being reviewed is described in the prompt logic.
Audit Metadata