cloudbase-code-review
Warn
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: MEDIUMCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs users to manually create and execute a Node.js script (
cloudbase-lint.mjs) using source code provided inreferences/lint-rules/README.md. Although the skill includes a safety warning and requires explicit user consent, this workflow involves executing code provided within instruction data. - [DATA_EXPOSURE]: The included linting script utilizes
node:fsto recursively traverse and read the content of all source files (.ts,.tsx,.js,.jsx,.html,.sql,.json) within a specified project directory. While this is the intended functionality of a linter, it constitutes a broad file access pattern across the local environment. - [PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data (project source code) which serves as a surface for indirect prompt injection. The analysis process lacks explicit boundary markers or sanitization to prevent malicious instructions embedded in reviewed files from influencing the agent's behavior during the review phase.
Audit Metadata