check
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust pre-merge validation workflow without any malicious patterns.\n
- [PROMPT_INJECTION]: The instructions do not attempt to bypass safety filters or override system constraints. The use of subagents for code review is a structural feature of the skill designed to provide higher quality feedback by using a different model than the one that wrote the code.\n
- [REMOTE_CODE_EXECUTION]: The skill uses standard developer tools like
gitand local agent tools (Read, Write, Bash). It does not download or execute code from untrusted remote sources. Portability instructions emphasize using native agent tools over literal shell scripts.\n - [DATA_EXFILTRATION]: No network exfiltration patterns or hardcoded credentials were found. Findings are written to local files (e.g.,
docs/reviews/).\n - [PRIVILEGE_ESCALATION]: There are no requests for elevated permissions (sudo, chmod 777, etc.). The skill operates within the agent's standard environment.\n
- [DYNAMIC_CONTEXT_INJECTION]: The skill does not use the
!commandsyntax for silent execution at load time. Subagent spawning is explicitly defined and triggered by user intent.
Audit Metadata