code-quality

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data (code diffs and repository documentation) which serves as an ingestion point for potentially malicious instructions. If the code being reviewed contains adversarial prompts, it could influence the agent's behavior during the review or when executing project tools.
  • Ingestion points: Git diff output and project files (SKILL.md Step 1).
  • Boundary markers: None. The skill lacks explicit markers to differentiate between instructions and the data being analyzed.
  • Capability inventory: Execution of git, pre-commit, python manage.py, and pytest (SKILL.md Steps 1 & 2).
  • Sanitization: None. The skill does not validate or sanitize the content of the files or diffs before processing.
  • [COMMAND_EXECUTION]: The skill requires the execution of multiple shell commands to retrieve context and run project-specific quality tools.
  • Evidence: Commands such as git fetch, git diff, pre-commit run, python manage.py check, and pytest are used to perform the review.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 04:10 AM