code-mentor
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is composed entirely of markdown instructions and reference examples. It does not execute shell commands, perform network requests, or handle sensitive credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data (user-provided code).
- Ingestion points: The activation contract and execution steps specify reading user code and configuration files for review.
- Boundary markers: The skill defines a strict 'Output Contract' and 'Decision Gates' to structure the agent's response.
- Capability inventory: The skill itself does not request any dangerous capabilities like subprocess execution or network access; it purely generates text-based review feedback.
- Sanitization: No explicit sanitization of the input code is performed, but as the skill's only capability is text generation, the risk of technical exploitation is negligible.
Audit Metadata