skills/keboola/ai-kit/review/Gen Agent Trust Hub

review

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands using git, grep, and uv run ruff. These are used appropriately for the stated purpose of analyzing code diffs, identifying component IDs, and performing automated linting/formatting checks.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data in the form of code changes and pull request diffs. While it lacks explicit boundary markers for this data, its capabilities are limited to development-related tasks, and it includes explicit security instructions to anonymize any identifying information in its output.
  • Ingestion points: git diff output and repository files accessed via Read and Grep tools.
  • Boundary markers: Absent; code content is processed directly within the instructional flow.
  • Capability inventory: Shell command execution via Bash (git, grep, ruff), file system access (Read, Glob, Grep), and telemetry querying via external MCP tools.
  • Sanitization: Not explicitly implemented for the input, but the skill enforces strict anonymization rules for the final output to prevent data leakage.
  • [EXTERNAL_DOWNLOADS]: The use of uv run ruff may result in the automatic download and installation of the ruff linting tool from official package registries if it is not already present in the environment. This is a standard development practice and uses well-known, trusted tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 07:50 AM