pr-check-static
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a guide for code quality and security reviews, including checks for hardcoded credentials and race conditions.
- [COMMAND_EXECUTION]: Executes
git diff main...HEADto analyze changes. This is a standard and necessary operation for the skill's core functionality of code review. - [SAFE]: Includes a specific check (B20) to identify and prevent the inclusion of real API tokens or credentials in documentation files, which is a positive security practice.
- [PROMPT_INJECTION]: The skill processes untrusted external data in the form of pull request diffs. While it does not implement explicit boundary markers or delimiters to isolate code content from instructions, the skill's primary function is restricted to identifying and reporting issues rather than executing logic based on the code's content. Mandatory Evidence Chain (Category 8):
- Ingestion points:
git diff main...HEADinSKILL.md. - Boundary markers: Absent.
- Capability inventory: Reporting findings (text output).
- Sanitization: Absent.
Audit Metadata