code-review-expert
Pass
Audited by Gen Agent Trust Hub on Mar 2, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill operates on untrusted external data (source code) through
git diffandrgcommands, which constitutes an indirect prompt injection surface. While malicious code being reviewed could attempt to influence the agent's behavior, the skill maintains a 'review-first' workflow that requires explicit human confirmation before any changes are implemented. - [EXTERNAL_DOWNLOADS]: The README provides installation instructions via standard Node.js package managers (
npx). These references target the author's own repository and are standard for skill distribution. - [COMMAND_EXECUTION]: The skill utilizes command-line tools including
git status,git diff,rg(ripgrep), andgrepto analyze the local codebase. These operations are restricted to read-only metadata and diffing tasks necessary for code analysis.
Audit Metadata