code
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates entirely within the local workspace environment. Its primary function is to read local source code and provide qualitative feedback based on a structured set of internal prompt files (prompts/code-review/*.md).
- [COMMAND_EXECUTION]: The package includes a Node.js CLI script (bin/code-review.js) intended for workspace setup. Analysis of this script confirms it is limited to standard filesystem operations—checking for file existence, creating directories, and copying files from the package to the local workspace. It does not perform any network operations, privilege escalation, or arbitrary code execution.
- [DATA_EXFILTRATION]: No network-enabled tools or commands (such as curl, wget, or fetch) are utilized by the skill or its installation script. The agent's instructions focus solely on analyzing code and generating textual reports for the user.
- [PROMPT_INJECTION]: The instructions in SKILL.md are well-structured and focus on task performance. There are no attempts to bypass safety filters, override system prompts, or induce restricted behaviors.
Audit Metadata