do-review-ai-writing
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses standard command-line utilities (
git,find,gh) to collect and analyze text from within the repository. These operations are well-defined and align with the skill's primary purpose of reviewing documentation and code artifacts. - [SAFE]: Text analysis is performed against a static set of pattern categories (vocabulary, filler, formatting, etc.) defined in the included reference files. There is no dynamic code execution or remote script loading.
- [SAFE]: The skill incorporates a 'Review Verification Protocol' designed to ensure that findings are accurate and evidence-based, reducing the risk of model hallucinations during the review process.
- [SAFE]: The skill follows secure metadata practices, including a restrictive configuration (
disable-model-invocation: true) and appropriate scoping of file system operations. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from source code files, documentation, and PR descriptions, creating an inherent surface for indirect prompt injection. However, this is evaluated as safe because the skill's capabilities are limited to text analysis and report generation without high-privilege execution sinks.
- Ingestion points: SKILL.md (Step 5) reads local files, git logs, and GitHub PR bodies.
- Boundary markers: The instructions do not specify explicit boundary markers for the ingested text.
- Capability inventory:
git,find,gh(subprocess),python3(subprocess), and file system write for the JSON report. - Sanitization: None explicitly mentioned for the analyzed text content.
Audit Metadata