code-review-workflow
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill defines a workflow for reviewing code changes, regressions, and security risks. It utilizes a vendor-specific MCP tool 'kavion_write_report' and a specific directory '.kavion/reports/' for storing findings, which is consistent with the skill's purpose.
- [PROMPT_INJECTION]: The skill analyzes untrusted external data (code diffs and files), which is an inherent surface for indirect prompt injection. Ingestion points: External code diffs and file content. Boundary markers: None specified in the workflow. Capability inventory: File writing via tool and direct path. Sanitization: Not mentioned in instructions. This is evaluated as safe given the context of a code review tool.
Audit Metadata