production-readiness-review
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python and Node.js scripts (e.g.,
.claude/scripts/code_graph,.claude/scripts/ai-signal-scan.cjs) to perform static analysis, structural impact evaluation, and AI signal scanning. These tools are assumed to be part of the project's internal security/tooling infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of backend source code and API definitions.
- Ingestion points: Processes files identified via
git diffor arguments, and readsdocs/project-config.json. - Boundary markers: Relies on
file:lineevidence citations and structured markdown templates to isolate findings. - Capability inventory: Includes local shell command execution (Python/Node), file writes to
tmp/reports/, and the ability tospawn_agent. - Sanitization: Employs a mandatory 'Why-Review Findings Validation Gate' to adversarially test findings before reporting and a 'Fresh Re-Review' protocol for sub-agents to mitigate confirmation bias.
- [DYNAMIC_EXECUTION]: The skill dynamically generates prompts for sub-agents using standard templates (e.g.,
SYNC:review-protocol-injection) to perform independent re-reviews of code fixes without context from previous iterations.
Audit Metadata