receiving-code-review
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon code review feedback from external sources, which creates a surface for untrusted data to enter the agent's context.
- Ingestion points: External reviewer feedback as referenced in SKILL.md.
- Boundary markers: The instructions mandate a 'Verify before implementing' phase and specific technical checks to validate external suggestions.
- Capability inventory: The skill allows for codebase modifications (implementation), searching via
grep, and network communication viagh api. - Sanitization: The skill includes requirements to check for regressions and technical correctness before applying changes.
- [COMMAND_EXECUTION]: The skill utilizes standard command-line utilities such as
grepfor searching the codebase and the GitHub CLI (gh api) for replying to pull request comments. These interactions are scoped to the task but involve executing system commands based on the context of the review process.
Audit Metadata