code-review
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions define a process for automated code review and report generation.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze project source code and configuration files (e.g.,
CLAUDE.md,AGENTS.md). While this provides an attack surface for indirect prompt injection if the files contain malicious instructions, the skill is scoped to analysis and report writing. It does not possess network access or arbitrary command execution capabilities, which limits the potential impact of such an injection to the content of the generated report. - Ingestion points: Project source code, entry points, and local configuration files (
CLAUDE.md,AGENTS.md). - Boundary markers: None explicitly defined for ingested code snippets.
- Capability inventory: File system read access for analysis and file system write access to save the
.mdreport to the application root. - Sanitization: No explicit sanitization of ingested content before inclusion in the report findings.
Audit Metadata