skills/samhvw8/dotfiles/code-quality/Gen Agent Trust Hub

code-quality

Pass

Audited by Gen Agent Trust Hub on Oct 24, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes code review feedback from external sources, which constitutes an ingestion point for untrusted data that could contain malicious instructions.
  • Ingestion points: External reviewer feedback is ingested and evaluated as described in references/code-review-reception.md.
  • Boundary markers: The instructions do not define strict technical delimiters for the external feedback strings, although they advise restating requirements for clarity.
  • Capability inventory: The skill can execute shell commands like git and run project tests via scripts/find-polluter.sh.
  • Sanitization: The skill provides strong instructional mitigations, requiring the agent to be skeptical of external feedback and to perform independent technical verification before implementing any suggested changes.
  • [COMMAND_EXECUTION]: The skill includes a utility script scripts/find-polluter.sh for debugging test suite pollution.
  • Evidence: The script executes npm test "$TEST_FILE" for files matching a provided pattern. This is a functional requirement for identifying state pollution in the development environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 24, 2026, 01:35 PM