code-review-claude-skills
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions recommend running
uvx skilllint@latest check --fix <path>, which involves downloading a package from an external registry during the review process. - [REMOTE_CODE_EXECUTION]: The recommendation to use
uvxto execute theskilllintpackage constitutes the execution of code fetched from a remote repository at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted content from developer-controlled files such as
SKILL.md, agent frontmatter, andplugin.jsonfiles. - Ingestion points: The skill processes
SKILL.md, agent frontmatter files, andplugin.jsonduring the code review workflow. - Boundary markers: The provided instructions do not specify any boundary markers or delimiters to isolate the content of the analyzed files from the agent's instructions.
- Capability inventory: The skill encourages the execution of shell commands (
uvx) as part of its workflow. - Sanitization: There are no documented sanitization or filtering steps for the data being read from the external files.
Audit Metadata