code-review-excellence

Pass

Audited by Gen Agent Trust Hub on Mar 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill is a comprehensive collection of code review guidelines and checklists for numerous programming languages and frameworks. No malicious code, unauthorized network activity, or credential harvesting was found.
  • [COMMAND_EXECUTION]: The core skill definition in SKILL.md authorizes the use of the Bash tool to run linting, testing, and build scripts. This is intended to verify the quality of the code under review by allowing the agent to execute standard development commands within the repository environment.
  • [PROMPT_INJECTION]: The skill is designed to process untrusted input from pull requests, creating an indirect prompt injection surface.
  • Ingestion points: PR diffs, descriptions, and linked issues accessed via the Read, Grep, and Glob tools, as well as the pr-analyzer.py script.
  • Boundary markers: Not explicitly defined in the agent instructions.
  • Capability inventory: Access to Bash for command execution (e.g., builds/tests) and WebFetch for external documentation retrieval.
  • Sanitization: No explicit sanitization of untrusted code content before execution or processing is specified in the prompt instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 9, 2026, 07:54 AM
Security Audit — agent-trust-hub — code-review-excellence