receiving-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes code review feedback from external sources, which constitutes an ingestion point for untrusted data.
- Ingestion points: External code review comments and feedback from partners (SKILL.md).
- Boundary markers: The instructions mandate a 'READ', 'UNDERSTAND', and 'VERIFY' phase before action, effectively acting as a logical boundary for processing input.
- Capability inventory: Mentions of
grepfor codebase searching and GitHub API for communication; implies the ability to modify code ('IMPLEMENT'). - Sanitization: The skill uses behavioral steering to enforce skepticism and technical verification of all external suggestions, which serves as a mitigation strategy against malicious or incorrect feedback.
- [COMMAND_EXECUTION]: The skill provides templates for using development tools such as
grepand the GitHub CLI (gh api). - Evidence: Instructions for querying the codebase for usage patterns and replying to GitHub pull request comment threads.
- Context: These tools are used within their intended purpose for code maintenance and collaboration.
Audit Metadata