zig-code-review
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is self-contained and operates within the local conversation context, utilizing vendored documentation files (
references/code-review.md,references/style-guide.md) to maintain privacy and security. - [COMMAND_EXECUTION]: The workflow involves legitimate use of standard Zig tooling, specifically
zig fmtandzig version, to perform mechanical project checks. These operations are essential for the skill's stated purpose and do not pose a privilege escalation or remote execution risk. - [PROMPT_INJECTION]: The skill processes untrusted input in the form of user-provided Zig code and diffs, representing an indirect prompt injection surface (Ingestion points: user code snippets/diffs mentioned in
SKILL.md; Boundary markers: none; Capability inventory:zig fmt,zig versioninSKILL.md; Sanitization: none). However, this risk is assessed as safe because the skill instructs the agent to treat the input as data for static analysis rather than as a source of commands or instruction overrides.
Audit Metadata