code-quality-review
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python and Node.js scripts (e.g., .claude/scripts/code_graph, .claude/scripts/ai-signal-scan.cjs) to perform graph analysis and AI signal scanning.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted source code and diffs during the review process. * Ingestion points: Source code logic, handlers, services, and documentation files. * Boundary markers: The skill uses a structured report-driven approach but lacks specific delimiters for untrusted code content. * Capability inventory: Execution of local scripts and writing reports to tmp/reports/. * Sanitization: No explicit sanitization of code content before processing is mentioned.
Audit Metadata