code-review-ai-ai-review
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions and code templates for integrating code review workflows with established security tools such as CodeQL, SonarQube, Semgrep, and Snyk. These references are documented neutrally as they pertain to standard industry practices.
- [SAFE]: The provided GitHub Actions and Python script examples follow security best practices by recommending the use of environment variables and CI/CD secrets (e.g., OPENAI_API_KEY, GITHUB_TOKEN) for managing sensitive credentials.
- [SAFE]: The skill identifies an indirect prompt injection surface where the agent processes external data such as pull request diffs and descriptions. This is documented as a necessary component of the skill's primary purpose (code review) and does not involve malicious intent.
- [SAFE]: Command execution patterns in the provided scripts (e.g., subprocess calls to sonar-scanner and semgrep) are restricted to specific, well-known static analysis tools and do not facilitate arbitrary command injection.
Audit Metadata