rpi-review
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- Local Command Execution: The skill is designed to discover and execute validation commands found within the project environment, such as those in a Makefile, package.json, or pyproject.toml. This allows the agent to verify the implementation using the project's own testing and build infrastructure as intended for the review process.
- Processing Local Project Artifacts: The skill ingests data from local files, including implementation plans and changes logs located in the .copilot-tracking directory. This information is used to populate review templates and assess task completion.
- Subagent Integration: The skill utilizes subagents for specialized validation tasks. This modular approach facilitates analysis of implementation quality while maintaining a structured review protocol.
- Indirect Prompt Injection Surface: The skill processes various project files to synthesize findings, which is a common pattern for automated review tools.
- Ingestion points: Project configuration files and subagent output files located in the .copilot-tracking/ directory.
- Boundary markers: The skill employs structured markdown templates to separate different types of metadata and findings.
- Capability inventory: The agent can execute shell commands found in the project configuration and invoke subagents for validation.
- Sanitization: The instructions focus on summarizing findings and recording them into a predefined log format, minimizing the direct reflection of raw input into commands.
Audit Metadata