code-review-mastery
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands including
git diffto analyze code changes andlsto check for the presence of recommended companion skills in standard installation directories. These commands are used as intended for the skill's functionality. - [PROMPT_INJECTION]: The skill ingests untrusted data from git diffs. This creates a potential surface for indirect prompt injection where malicious instructions embedded in the code being reviewed could attempt to influence the agent's behavior. However, the risk is limited by the skill's structured reporting logic and its primary role as a reporting tool.
- [SAFE]: The skill reads local project configuration files such as
.eslintrc,package.json, andCLAUDE.mdto calibrate its review. These file access operations are necessary for context-aware analysis and do not involve exfiltration of data to external sources.
Audit Metadata