code-review-ai-ai-review
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructional content and code examples for performing code reviews. All external tools mentioned (CodeQL, SonarQube, Semgrep, Snyk, GitGuardian, TruffleHog) are industry-standard security and static analysis tools.
- [SAFE]: The provided scripts for CI/CD integration and AI orchestration use environment variables for secrets management (e.g.,
OPENAI_API_KEY,GITHUB_TOKEN), which is a recommended security practice. - [COMMAND_EXECUTION]: The skill includes shell commands (
trufflehog,sonar-scanner,semgrep,codeql) and Python subprocess calls. These are documented as part of an automated workflow and are limited to the intended purpose of the skill. - [PROMPT_INJECTION]: The skill includes prompts for LLMs (e.g., Claude 4.5, GPT-5). These prompts are designed to perform code analysis and do not attempt to bypass safety filters or override agent behavior maliciously.
- [DATA_EXFILTRATION]: While the skill interacts with the GitHub API and various analysis services, these interactions are standard for code review workflows and do not target sensitive user data beyond the codebase being reviewed.
Audit Metadata