matematic-patron-pr-review-pl

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute standard development utilities such as git diff, gh pr diff, and rg (ripgrep) to analyze code changes. These are used strictly for their intended purpose of fetching and searching source code.
  • [EXTERNAL_DOWNLOADS]: The skill references external GitHub repositories, specifically dograh-hq/dograh for structural patterns and the author's own matematic-anonimizacja-pl for PII protection. These are well-known or vendor-controlled sources.
  • [PROMPT_INJECTION]: The skill processes untrusted input in the form of pull request diffs and repository files. As a code analysis tool, this creates a surface for indirect prompt injection where instructions embedded in the code under review could potentially target the agent. However, the skill implements structured analysis rules and output formatting which act as defensive constraints.
  • [DATA_EXFILTRATION]: The instructions contain proactive security policies to detect and block the exposure of sensitive information, such as PII (PESEL, NIP, names) and credentials (API keys, bearer tokens) in logs and public artifacts, which is a security best practice for LegalTech applications.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 08:28 AM
Security Audit — agent-trust-hub — matematic-patron-pr-review-pl