react-refactor-tournament
Pass
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Workflowtool to execute a local JavaScript orchestration script (react-refactor-tournament.workflow.js) and theBashtool for Git operations and environment variable resolution. These tools are used legitimately to manage code refactoring workflows. - [COMMAND_EXECUTION]: Employs dynamic context injection (
! echo ...) to resolve the absolute path of its bundled workflow script at runtime. This is a benign implementation used to ensure the agent correctly identifies its own assets regardless of installation path. - [EXTERNAL_DOWNLOADS]: The skill requires the
vercel-react-best-practicesskill. As this dependency originates from a well-known service (Vercel), it is considered a safe reference and does not escalate the security risk. - [SAFE]: The skill includes safety constraints, such as only operating on isolated Git worktree branches and explicitly refusing to push or merge changes automatically, ensuring human oversight for all modifications.
Audit Metadata