ha-quality-review
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill recommends several local shell commands for linting and validation, including
ruff,mypy,grep, andpython3. These are standard tools in a development environment and are used here to ensure code quality and schema compliance.\n- [EXTERNAL_DOWNLOADS]: Includes a reference to the official Home Assistant brands repository on GitHub (github.com/home-assistant/brands). This is a well-known service and the reference is documented neutrally for the purpose of integration branding compliance.\n- [PROMPT_INJECTION]: The skill operates on third-party integration code, which introduces an indirect prompt injection surface. This is inherent to its primary purpose as a code review tool.\n - Ingestion points:
SKILL.md(Review Process) specifies the location of integration files to be analyzed.\n - Boundary markers: Absent; there are no specific delimiters to separate reviewed code from agent instructions.\n
- Capability inventory:
SKILL.md(Quick Validation Commands) identifies file-read and local command execution capabilities.\n - Sanitization: Absent; the skill does not explicitly sanitize the content of the integration files before processing.
Audit Metadata