review-methodology-foundations

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the subprocess module in its utility and testing scripts to execute external analysis and validation tools.
  • scripts/signoff_preflight.py runs a narrative linter to ensure that generated report text accurately reflects the underlying statistical data.
  • scripts/test_render_record_integration.py and other test files invoke Rscript to perform meta-analysis calculations and generate figures.
  • [DYNAMIC_EXECUTION]: Statistical validation and reporting depend on the dynamic invocation of local Python and R scripts.
  • Auxiliary scripts are called using sys.executable to ensure they run within the same Python environment as the main skill.
  • R-based plotting scripts are executed at runtime to produce meta-analysis visualizations such as forest and funnel plots.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface through the ingestion and processing of JSON, YAML, and CSV files generated within the project workspace.
  • Scripts like scripts/audit_package.py and scripts/registration_reconcile.py parse these artifacts to create comprehensive audit summaries for user review.
  • To mitigate risks associated with untrusted data, the skill implements a verification mechanism using SHA-256 hashes (defined in scripts/decision_block_util.py) to confirm that the decision points presented to the user have not been altered prior to sign-off.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 11:00 AM
Security Audit — agent-trust-hub — review-methodology-foundations