open-code-review-setup
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill configures GitHub Action workflows that use the "alibaba/open-code-review" action. This action is maintained by a well-known organization (Alibaba) and is correctly pinned to a specific commit SHA (1c8f930fc923753b17b80f633aea54274fc83825), which is a security best practice to prevent supply chain attacks.
- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI ("gh") for repository configuration and "curl" within the generated workflows to perform connectivity preflight checks against the OpenRouter API. These are standard operations necessary for the skill's stated purpose of automating code review infrastructure.
- [CREDENTIALS_UNSAFE]: The skill handles an API token ("OCR_LLM_AUTH_TOKEN") for LLM access but includes explicit guardrails and instructions to prevent accidental exposure. It provides a secure method for migrating secrets from local environment files to GitHub's encrypted secret store using piped commands.
Audit Metadata