code-quality

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [Command Execution]: The skill uses local shell commands including git merge-base, git diff, and git ls-files to identify changed code. These are standard development operations used here to scope the analysis to the contributor's specific changes.
  • [Processing Untrusted Data]: The skill ingests C# source code and diff hunks to perform pattern matching against established coding rules. As the skill processes user-generated content, there is a theoretical surface for indirect prompt injection where instructions could be embedded in code comments. However, the skill is structured to use these inputs strictly as data for analysis.
  • Ingestion points: Diff hunks from git diff and file contents via view (SKILL.md).
  • Boundary markers: None explicitly defined for the AI's consumption of code snippets.
  • Capability inventory: File reading (view), git operations (git), and targeted file modification if the user explicitly requests a fix.
  • Sanitization: The skill relies on pattern matching for specific C# rules rather than executing the provided code.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 07:43 PM