code-ultrareview
Pass
Audited by Gen Agent Trust Hub on May 28, 2026
Risk Level: SAFEPROMPT_INJECTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is subject to indirect prompt injection risks (Category 8) as it ingests untrusted data from CLAUDE.md files, PR bodies, and planning artifacts. It mitigates this by restricting axis reviewers and validators to read-only operations. Mandatory Evidence Chain: 1. Ingestion points: CLAUDE.md, PR/Issue bodies, and Forge/Apex plans (scripts/derivation/run.py, scripts/scope.py). 2. Boundary markers: Absent. 3. Capability inventory: Main agent has Bash and Task execution; axis subagents are read-only (SKILL.md). 4. Sanitization: Absent.\n- [REMOTE_CODE_EXECUTION]: When the --verify-build flag is used, the skill executes the local project's test suite (e.g., npm test, pytest, cargo test). This is a documented feature designed to confirm axis findings via build signals.\n- [EXTERNAL_DOWNLOADS]: The Phase 2 tool battery uses npx and uvx to run well-known developer tools like semgrep, lizard, and knip directly from official registries.\n- [COMMAND_EXECUTION]: Several scripts utilize the git and gh (GitHub) CLI tools to resolve repository topology and fetch metadata for the current PR or branch.
Audit Metadata