sf-code-review
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates entirely within the local project environment using a predefined set of scripts and documentation files. It enforces a structured workflow that prioritizes specification compliance and safety checks.- [COMMAND_EXECUTION]: The skill utilizes several local Node.js scripts (e.g., "artifact-graph-status.mjs", "create-artifact.mjs", "gate.mjs") to automate the code review gate process. These scripts are located in the ".specforge/core/scripts/" directory and are internal framework components.- [DATA_EXFILTRATION]: While the skill reads sensitive implementation details and code diffs to perform its review, all operations are confined to the local filesystem. No external network requests or unauthorized data transfers were detected.- [PROMPT_INJECTION]: The instructions include specific directives to ignore external review agents and rely exclusively on local SpecForge instructions, which effectively mitigates risks from third-party instruction sources.
Audit Metadata