coding-standards

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's bootstrap and health check processes use pip to install the tree-sitter, tree-sitter-typescript, and tree-sitter-javascript packages from the well-known PyPI registry. These libraries are used for the skill's primary purpose of performing Abstract Syntax Tree (AST) analysis on source code.
  • [COMMAND_EXECUTION]: The skill utilizes subprocess.run and os.execv for several infrastructure and functional tasks:
  • bootstrap.py uses os.execv to re-execute itself if a newer Python interpreter (3.10+) is found on the system path, ensuring compatibility with its dependencies.
  • session-health-check.py and other hooks execute git commands to detect code changes and pip commands to maintain the skill's execution environment.
  • judge-comments.py invokes the claude CLI in a restricted mode (no tools, no MCP, single turn) to perform out-of-band analysis of source code comments.
  • [PRIVILEGE_ESCALATION]: The script _bootstrap/permissions.py modifies the agent's platform configuration (settings.json or settings.local.json) to add allow rules for the skill's own Python scripts (bootstrap.py and review-files.py). This is an intentional design choice to prevent the agent from prompting the user for permission every time the skill's core scripts are executed.
  • [DYNAMIC_EXECUTION]: The skill uses __import__ in _bootstrap/dependencies.py to dynamically check for the presence of required packages before attempting to use them for AST-based code audits.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 03:37 PM