meow-review
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several subcommands of the
mfl(MeowFlow) CLI tool, includingstatus,thread status, andhandoff. It also invokespnpmto run repository-specific scripts for validation. These commands are integral to the skill's function as a code reviewer. - [EXTERNAL_DOWNLOADS]: The instruction to run
mfl agent update-selfindicates a self-updating mechanism for the agent's CLI component. As this is a vendor-provided tool (MeowFlow) for the developer's workflow, this is a standard administrative operation. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources such as git diffs and thread statuses via
mfl thread status. While processing untrusted data (like code diffs) is an attack surface, it is the primary intended function of a code review tool. No high-risk capabilities are exposed to this untrusted data without user-defined context.
Audit Metadata