Secure Code Review
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions define a defensive and security-oriented process for code review, focusing on identifying high-impact vulnerability classes such as injection, SSRF, and broken authorization. It does not perform any dangerous actions such as network requests, sensitive file access, or remote code execution.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data including source code, pull request diffs, and developer comments, which represents an attack surface for indirect prompt injection via code comments. However, this risk is intrinsic to the primary function of code analysis and is mitigated by the lack of exploitable capabilities within the skill itself. Ingestion points: Source code, diffs, and PR data provided to the agent as described in SKILL.md. Boundary markers: None specified; the skill relies on the agent to distinguish between code and instructions. Capability inventory: Analytical output only. Sanitization: None.
Audit Metadata