code-review
Pass
Audited by Gen Agent Trust Hub on Jul 2, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Command Execution for Repository Interaction: The skill is designed to interact with the local environment to compute code diffs and gather repository metadata. This is an expected behavior for a tool whose primary purpose is to review code changes and provide contextual feedback within a development workflow. Evidence is found in
references/context-bootstrap.mdwhere the agent is instructed to "Compute the diff once from the selected base branch." - Human-in-the-Loop Verification: The skill explicitly prevents automated external reporting by requiring manual approval from a human reviewer. This design significantly reduces the risk of accidental data exposure or unintended automated actions. This is detailed in
references/emission-modes.md, which defines guardrails requiring an "Explicit human confirmation" and an "Active-engagement self-review gate" before any data is posted to external platforms. - External Service Integration: The skill includes functionality to communicate with well-known developer platforms for posting review results. These integrations target established services and are central to the skill's utility in modern software development environments. References to GitHub, GitLab, and Azure DevOps integration are found in
references/emission-modes.mdandreferences/cross-skill-forks.md. - Untrusted Input Processing Surface: As the skill processes code diffs which may contain arbitrary text, it has a theoretical surface for indirect instructions within data. The skill manages this consideration by grounding its analysis in factual walkthroughs (Register 1) and enforcing human-mediated validation before any findings are synthesized or emitted. The ingestion point is the code diff identified in
references/context-bootstrap.md.
Audit Metadata