code-quality
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [Command Execution]: The skill uses local shell commands including
git merge-base,git diff, andgit ls-filesto identify changed code. These are standard development operations used here to scope the analysis to the contributor's specific changes. - [Processing Untrusted Data]: The skill ingests C# source code and diff hunks to perform pattern matching against established coding rules. As the skill processes user-generated content, there is a theoretical surface for indirect prompt injection where instructions could be embedded in code comments. However, the skill is structured to use these inputs strictly as data for analysis.
- Ingestion points: Diff hunks from
git diffand file contents viaview(SKILL.md). - Boundary markers: None explicitly defined for the AI's consumption of code snippets.
- Capability inventory: File reading (
view), git operations (git), and targeted file modification if the user explicitly requests a fix. - Sanitization: The skill relies on pattern matching for specific C# rules rather than executing the provided code.
Audit Metadata