pre-push-review

Pass

Audited by Gen Agent Trust Hub on Aug 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • External Downloads: The skill fetches a markdown file containing review criteria from the official microsoft/amplifier-app-actions GitHub repository using web_fetch. This is a routine pattern for centralizing development guidelines and utilizes a trusted source.
  • Command Execution: The workflow utilizes bash to run git diff and grep. These commands are used to orient the agent on changes and search for specific code patterns (such as stale mocks or environment variable mutations) within the local repository. This is an appropriate and common use of shell tools for code analysis.
  • Indirect Prompt Injection: Because the skill analyzes source code and external documentation, there is a potential surface where comments or content within the analyzed files could attempt to influence the agent's output. However, the skill's focus on specific structural checks and its use of a critique role provide significant safeguards against this consideration.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 28, 2026, 03:15 AM
Security Audit — agent-trust-hub — pre-push-review