qe-sherlock-review
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill provides a structured framework for investigating implementation claims through systematic observation and verification.
- [COMMAND_EXECUTION]: The skill references standard development commands such as
git diff,git log,git blame, andnpm test. These are utilized for their intended purposes of code analysis and verification within a local development context, with no evidence of malicious command injection. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data (PR descriptions, commit messages, and external code changes). However, it explicitly mitigates deception risks by instructing the agent to ignore subjective claims and rely only on empirical, reproducible evidence gathered through code execution and testing.
Audit Metadata