gh-review-requests

Pass

Audited by Gen Agent Trust Hub on Aug 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run in scripts/fetch_review_requests.py to invoke the gh (GitHub) CLI. This is a legitimate and standard use of a developer tool to interact with a well-known service (GitHub). The script uses a list-based argument format for subprocess.run, which is a best practice that mitigates command injection risks.- [EXTERNAL_DOWNLOADS]: The skill references the official uv installation documentation from astral.sh, which is a well-known and trusted package management tool in the Python ecosystem.- [DATA_EXPOSURE]: The script reads notification and PR metadata from GitHub. It processes this information locally and outputs a summary to standard output for the user. No sensitive environment variables or local credentials are accessed or transmitted to external third-party domains.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 14, 2026, 01:43 PM
Security Audit — agent-trust-hub — gh-review-requests