codex-pr-review
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
node:child_processto execute the GitHub CLI (gh) for PR metadata retrieval and GraphQL queries. These interactions are scoped to the repository and PR identified by the user. - [EXTERNAL_DOWNLOADS]: The
watch-codex-pr.mjsscript performs network operations via the GitHub GraphQL API to monitor pull request state. This is a well-known service used for the skill's primary purpose of PR review automation. - [REMOTE_CODE_EXECUTION]: While the skill orchestrates 'fixer' sub-agents to apply code changes, this is an architectural pattern for task delegation within the agent framework and does not involve executing arbitrary code from untrusted remote sources.
Audit Metadata