post-implementation-review-gate
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust framework for post-implementation reviews. It emphasizes the use of isolated, read-only subagents to provide an independent perspective on changes.
- [SAFE]: The workflow includes strict delegation preflights and provides clear criteria for when to escalate to an independent reviewer (e.g., changes to public APIs, security boundaries, or authentication logic).
- [SAFE]: The subagent instructions provided in
references/reviewer-contract.mdexplicitly forbid any write operations, deployment, or external communication, mitigating risks of unauthorized actions by the reviewer. - [SAFE]: The primary agent is instructed to treat subagent output as 'untrusted input,' requiring manual verification of every finding against code evidence and contracts before acceptance.
- [SAFE]: Evaluated fixtures and test cases demonstrate the skill's ability to identify real regressions, such as API compatibility breaks and CSS/UI defects, while correctly handling trivial edits without over-spawning agents.
- [SAFE]: No evidence of prompt injection, data exfiltration, or persistence mechanisms was found. The skill follows least-privilege principles by restricting the reviewer to a read-only context.
Audit Metadata