code-review
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill includes comprehensive 'Risk Lenses' (in
references/risk-lenses.md) that guide the agent to detect security vulnerabilities such as secret exposure, privilege expansion, and unsafe input handling in the code being reviewed.\n- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it processes untrusted data from external sources.\n - Ingestion points: Untrusted code changes, patches, and pull requests are read from the repository state as described in
SKILL.md.\n - Boundary markers: There are no explicit delimiters or 'ignore' instructions defined to separate analyzed code from agent instructions.\n
- Capability inventory: The agent is instructed to use tools like compilers, test runners, and AST analysis to verify findings (
SKILL.md, Step 4 and 8).\n - Sanitization: No specific sanitization or escaping of the ingested code is implemented.\n
- Context: This risk is intrinsic to the skill's purpose of code review and is handled through a structured methodology that prioritizes source-backed evidence.
Audit Metadata