mo-reviewer

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands for repository grounding and inspection, including git rev-parse, git status, git show, git diff, git grep, and git log. These are used in a read-only manner to verify the candidate commit and explore the codebase. It also executes a local validator script node scripts/mo-review-report.mjs.- [INDIRECT_PROMPT_INJECTION]: As a code review tool, the skill is exposed to untrusted data from the codebase diffs, specifications, and the review 'brief' provided by the coordinator.
  • Ingestion points: The target codebase files/diffs and the various fields of the review brief.
  • Boundary markers: The skill mandates a specific report grammar and uses an external validator script to ensure the agent's output is not influenced by embedded instructions in the reviewed content.
  • Capability inventory: Access to repository inspection tools (git) and report validation utilities (node). It has limited file writing capability for the report body.
  • Sanitization: The mo-review-report.mjs script acts as a sanitization and validation layer for all generated reports.- [DYNAMIC_EXECUTION]: The skill executes scripts/mo-review-report.mjs using Node.js to handle report templating and validation tasks. This is a local script intended to enforce the review protocol.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 04:08 PM