ai-code-review
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands to perform Git operations (
git rev-parse,git status,git diff) and to trigger external review tools (cr review,greptile review). These operations are consistent with the skill's stated purpose of reviewing local code changes. - [DATA_EXFILTRATION]: The skill transmits local code diffs to external SaaS providers (CodeRabbit and Greptile). This is the intended functionality. The skill mitigates risks of accidental exposure by instructing the agent to inspect the diff for sensitive information like credentials or private keys before sending data to the services.
- [SAFE]: The instructions contain multiple security safeguards. In the 'Preflight' section, it mandates checking for production data or keys before upload. In the 'Running Reviews' section, it explicitly warns that reviewer output should be treated as untrusted and verified manually before any code is applied or executed.
- [SAFE]: The external services utilized (CodeRabbit and Greptile) are well-known developer productivity platforms. The skill does not attempt to install these tools, assuming they are already present and authenticated in the user's environment.
Audit Metadata