constructive-code-review
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFENO_CODEINDIRECT_PROMPT_INJECTION
Full Analysis
- [NO_CODE]: The skill consists entirely of natural language instructions in markdown format. It does not include any scripts, executables, or configuration files that could perform actions on the host system.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data by reviewing code diffs and pull request descriptions provided by users.
- Ingestion points: User-pasted code diffs and PR metadata (SKILL.md).
- Boundary markers: The instructions do not specify the use of delimiters or specific warnings to ignore instructions embedded within the code being reviewed.
- Capability inventory: The skill itself has no capabilities to write files, execute commands, or access the network; its purpose is solely to guide the phrasing of text feedback.
- Sanitization: No sanitization methods are defined, but as the output is restricted to qualitative review comments, the impact of potential injection is negligible.
Audit Metadata