code-quality-check
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill establishes a structured methodology for read-only code reviews, focusing on evidence and production consequences. It explicitly prohibits editing production code during the review process.
- [COMMAND_EXECUTION]: The skill executes a bundled local Python script (
scripts/repo_signals.py) to detect hotspots like swallowed exceptions and security risks. This script is self-contained, uses only the Python standard library, and does not perform network operations. - [INDIRECT_PROMPT_INJECTION]: As a code review tool, the skill is designed to ingest and process untrusted external data (source code). The instructions guide the agent to run build systems and test suites to verify findings, which creates a potential surface for indirect prompt injection if the target codebase contains malicious build scripts. However, the skill includes strong mitigations by instructing the agent to ignore comments and docstrings in favor of executable code behavior.
- [DATA_EXPOSURE]: The skill contains logic to detect hardcoded credentials and secrets within a target codebase via regex patterns in
repo_signals.py. This is used for reporting purposes to the user and does not involve exfiltration to external domains.
Audit Metadata