cross-review
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several local shell and PowerShell scripts (e.g.,
wait-for-codex.sh,dirty-tree-probe.sh) and CLI tools (e.g.,node,codex) to monitor job status, perform environment setup, and verify the working tree state. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local filesystem (the files selected for review). This content is analyzed by AI models to generate code fixes. While malicious content in reviewed files could attempt to influence the models, the skill implements significant mitigations including cross-model validation and evidence-based research.
- Ingestion points: Target files identified for review in
SKILL.md(Step 2). - Boundary markers: Utilizes XML-tagged blocks and defined structured output contracts for model interactions.
- Capability inventory: File system write access via the Edit tool; network access via Exa MCP; subprocess execution for CLI tools and status scripts.
- Sanitization: Employs a bilateral consensus model where findings must be verified by both Claude and Codex (or confirmed via external evidence) before auto-application.
Audit Metadata