pre-push-review
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Downloads: The skill fetches a markdown file containing review criteria from the official
microsoft/amplifier-app-actionsGitHub repository usingweb_fetch. This is a routine pattern for centralizing development guidelines and utilizes a trusted source. - Command Execution: The workflow utilizes
bashto rungit diffandgrep. These commands are used to orient the agent on changes and search for specific code patterns (such as stale mocks or environment variable mutations) within the local repository. This is an appropriate and common use of shell tools for code analysis. - Indirect Prompt Injection: Because the skill analyzes source code and external documentation, there is a potential surface where comments or content within the analyzed files could attempt to influence the agent's output. However, the skill's focus on specific structural checks and its use of a critique role provide significant safeguards against this consideration.
Audit Metadata