review-code-complexity
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local source code, interfaces, and existing tests to perform architectural assessments. This process ingests potentially untrusted data that could contain malicious instructions designed to influence the agent.
- Ingestion points: The agent reads code implementations, symbol definitions, and test files from the local worktree during Phase 2 (SKILL.md).
- Boundary markers: The skill contains explicit instructions to remain within the review batch and strictly requires human approval before any implementation occurs (SKILL.md, Phase 3 and 4).
- Capability inventory: The agent has the ability to execute repository-defined tests, run diagnostic tools, and write code/test changes to the filesystem (SKILL.md, Phase 4).
- Sanitization: Safety relies on the human-in-the-loop approval gate where proposed changes and reasoning are reviewed before execution.
- [COMMAND_EXECUTION]: The skill is designed to execute external diagnostic tools and test suites already present in the user's environment.
- Evidence: Phase 1 and 4 of SKILL.md instruct the agent to discover and run "configured cyclomatic and cognitive complexity diagnostics" and "relevant behavioral and repository-required checks."
- [SAFE]: The skill demonstrates secure practices by refusing to install new tooling or modify thresholds without separate requests, and it gracefully handles missing dependencies by reporting them as gaps rather than attempting to bypass restrictions.
Audit Metadata