code-review-checklist
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is entirely instructional, providing markdown-based checklists and examples for code review practices. It does not perform any automated actions, command execution, or network requests.
- [CREDENTIALS_UNSAFE]: The file contains a mock API key (
sk_live_abc123xyz) used within a code block explicitly labeled as a 'Bad' example for security reviews. This is an educational placeholder and does not represent an actual credential leak or a request for the agent to use hardcoded secrets. - [PROMPT_INJECTION]: The skill defines a workflow for reviewing external data (source code in pull requests). This constitutes a vulnerability surface for indirect prompt injection.
- Ingestion points: Pull request content, code audits, and user-provided code files (SKILL.md).
- Boundary markers: Absent; the skill does not instruct the agent to use specific delimiters or ignore embedded instructions within the code being reviewed.
- Capability inventory: The skill does not explicitly use tools, but within the platform context, the agent may have access to shell, file system, or network tools to facilitate audits.
- Sanitization: Absent; the skill relies on the agent's internal safety filters and manual review checklists.
Audit Metadata