review-methodology-foundations
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
subprocessmodule in its utility and testing scripts to execute external analysis and validation tools. scripts/signoff_preflight.pyruns a narrative linter to ensure that generated report text accurately reflects the underlying statistical data.scripts/test_render_record_integration.pyand other test files invokeRscriptto perform meta-analysis calculations and generate figures.- [DYNAMIC_EXECUTION]: Statistical validation and reporting depend on the dynamic invocation of local Python and R scripts.
- Auxiliary scripts are called using
sys.executableto ensure they run within the same Python environment as the main skill. - R-based plotting scripts are executed at runtime to produce meta-analysis visualizations such as forest and funnel plots.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface through the ingestion and processing of JSON, YAML, and CSV files generated within the project workspace.
- Scripts like
scripts/audit_package.pyandscripts/registration_reconcile.pyparse these artifacts to create comprehensive audit summaries for user review. - To mitigate risks associated with untrusted data, the skill implements a verification mechanism using SHA-256 hashes (defined in
scripts/decision_block_util.py) to confirm that the decision points presented to the user have not been altered prior to sign-off.
Audit Metadata