gh-review-requests
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinscripts/fetch_review_requests.pyto invoke thegh(GitHub) CLI. This is a legitimate and standard use of a developer tool to interact with a well-known service (GitHub). The script uses a list-based argument format forsubprocess.run, which is a best practice that mitigates command injection risks.- [EXTERNAL_DOWNLOADS]: The skill references the officialuvinstallation documentation fromastral.sh, which is a well-known and trusted package management tool in the Python ecosystem.- [DATA_EXPOSURE]: The script reads notification and PR metadata from GitHub. It processes this information locally and outputs a summary to standard output for the user. No sensitive environment variables or local credentials are accessed or transmitted to external third-party domains.
Audit Metadata