code-review-claude-skills
Warn
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user or agent to run
uvx skilllint@latest check --fix <path>. This pattern involves downloading and executing the latest version of a package from a public registry (likely PyPI given theuvxrunner). The 'skilllint' package is not associated with a verified or pre-approved trusted source. - [COMMAND_EXECUTION]: The documentation explicitly promotes the execution of shell commands (
uvx skilllint) to automate formatting and linting of skill files. - [DATA_EXPOSURE]: The skill mentions automated linting and fixing of frontmatter files, which inherently involves reading and writing to configuration files (
SKILL.md,plugin.json) that may contain metadata or environment configuration.
Audit Metadata