qa-code-reviewer
Warn
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: MEDIUMOBFUSCATIONCOMMAND_EXECUTION
Full Analysis
- [OBFUSCATION]: The skill instructions contain a non-printable control character
\x01(Start of Heading) embedded within CLI command strings. This character is used as a separator between the script path and the command arguments (e.g.,qa_agent.py\x01assert-code-reviewandqa_agent.py\x01manifest). The use of non-standard, hidden characters in commands is a common technique to evade simple text-based security filters or monitoring tools. - [COMMAND_EXECUTION]: The skill provides the agent with a complex shell command involving
find,dirname, and subshell execution to resolve its directory path (QA_AGENT_DIR). This command scans multiple hidden directories within the user's home folder (~/.claude/skills,~/.agents/skills,~/.codex/skills) and executes a pipeline to extract the directory name, representing a broad file system discovery action.
Audit Metadata