soia-dev-review-panel
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a purely instructional framework for performing code reviews. It does not contain executable code, remote script downloads, or credential exfiltration patterns. It focuses on methodology (independent perspectives and refute-by-default verification).
- [COMMAND_EXECUTION]: The skill describes the use of CLI tools like
ghfor verification purposes but explicitly mandates using only non-side-effect, query-only, or dry-run flags (e.g.,--help,--dry-run). It specifically prohibits the execution of commands with side effects such as creation, deletion, or authorization changes. - [DATA_EXFILTRATION]: The skill documentation states that it does not persist data or require external credentials. It processes provided diffs or local skill directories within the current session context without sending them to third-party services.
- [REMOTE_CODE_EXECUTION]: While the skill mentions an installation command (
npx skills add), this is part of the standard documentation for skill deployment on the platform and is not a runtime execution vector within the skill's logic.
Audit Metadata