code-review-and-quality
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted code changes during the review process, which naturally exposes it to indirect prompt injection risks if a malicious actor embeds instructions within the code being reviewed.
- Ingestion points: Code changes, pull request descriptions, and external files submitted for review (documented in SKILL.md and references/definition-of-done.md).
- Boundary markers: The skill explicitly instructs the agent to treat all external data as untrusted and provides a dedicated 'Security' axis and checklist to verify the safety of ingested content.
- Capability inventory: The agent using this skill is expected to use file-reading tools to inspect the codebase and terminal tools to execute linters or tests as suggested by the verification guidelines.
- Sanitization: The skill itself acts as a sanitization and validation layer, providing extensive guidelines to identify vulnerabilities like SQL injection, XSS, and hardcoded secrets within the reviewed content.
- [SAFE]: The skill is authored by a well-known developer (addyosmani) and provides high-quality technical documentation and workflows for engineering excellence.
- [SAFE]: All external references point to reputable sources (GitHub, official documentation) and well-known development tools (Lighthouse, Axe, Jest, Playwright).
- [SAFE]: The security checklists provided are in accordance with OWASP standards and encourage defensive programming and secret management best practices.
Audit Metadata