review-anvil-improve-pr
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several system commands including
gh,git,uuidgen,jq, andpython3. These are used specifically for interacting with GitHub's API, managing local git state (checking out branches, committing fixes, pushing to origin), and generating unique identifiers for reporting. - [REMOTE_CODE_EXECUTION]: While the skill downloads and executes a helper script (
pr-helper.sh), this script is referenced from a trusted internal path within the local file system (part of the associatedreview-anvil-prskill), not a remote URL. Per system instructions, this is considered a safe local dependency of the agent's installed tools. - [DATA_EXFILTRATION]: The skill pushes local code changes to GitHub. This is the primary intended function of the skill (improving a PR) and is performed via the user's authenticated
gitandghclients. It does not send sensitive local data to third-party servers.
Audit Metadata