review-a11y
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of natural language instructions and metadata. No executable scripts, binaries, or configuration files are present.
- [COMMAND_EXECUTION]: The instructions do not involve the execution of shell commands. It explicitly states that the agent should only report findings and 'never edits code'.
- [DATA_EXPOSURE]: No hardcoded secrets, API keys, or sensitive local file paths (e.g., .ssh, .aws) are referenced in the skill.
- [INDIRECT_PROMPT_INJECTION]: While the skill ingests external data (code diffs or file paths provided by the caller), it possesses no capabilities to act on malicious instructions within that data, such as writing to the filesystem or making network requests.
- Ingestion points: Code diffs or paths passed to the skill (SKILL.md).
- Boundary markers: Not explicitly defined for the input data.
- Capability inventory: None; the skill is restricted to generating a text report.
- Sanitization: None specified.
- [EXTERNAL_DOWNLOADS]: No external URLs or remote resources are requested or downloaded by this skill.
Audit Metadata