skills/jeffabailey/skills/review-data/Gen Agent Trust Hub

review-data

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (fitness-config.py) to resolve configuration weights and scoring thresholds for the review. This script is located in the supporting scripts directory of the skill's parent environment.
  • [EXTERNAL_DOWNLOADS]: The instructions and documentation files reference several external blog posts and category pages on the author's domain (jeffbailey.us). these links serve as references for domain knowledge and scoring context and are treated as neutral vendor-owned resources.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading and analyzing untrusted content from the user's codebase, which creates a surface for indirect prompt injection attacks if malicious instructions are embedded within the files under review.
  • Ingestion points: Codebase files including SQL schema definitions (CREATE TABLE), ORM models, migration scripts, SQL/query-builder calls, and architectural documentation (ADRs or READMEs) found in the repository.
  • Boundary markers: The skill does not define specific delimiters or instructions for the agent to disregard natural language commands that might be found within the ingested data files.
  • Capability inventory: The agent has the capability to execute shell commands (python3), read filesystem contents, and generate reports at the repository root.
  • Sanitization: No explicit sanitization, filtering, or escaping of codebase content is mentioned in the instructions prior to analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 03:18 PM