specsfy-specialist-code-review
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is primarily composed of Markdown instructions and YAML configuration for an AI agent. No executable scripts, binaries, or shell commands were found across the files.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external data such as code diffs, pull request descriptions, and issue trackers. While this creates a surface for indirect prompt injection (Category 8), the skill is intended for read-only analysis. It does not possess capabilities to execute code, perform network requests, or write to the filesystem, which mitigates the risk associated with processing untrusted data.
- [EXTERNAL_DOWNLOADS]: The skill references documentation from well-known and trusted sources, including Google's Engineering Practices, the OWASP Code Review Guide, and Conventional Comments. These links are for informational purposes only and do not involve runtime downloads or execution of code.
- [COMMAND_EXECUTION]: There are no patterns of command execution or subprocess spawning. The skill's logic is restricted to providing logical steps for the AI agent to follow during analysis.
- [CREDENTIALS_SAFE]: No hardcoded credentials, API keys, or sensitive environment variable patterns were detected. The skill does not access sensitive local file paths.
Audit Metadata