coding-standards
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's bootstrap and health check processes use
pipto install thetree-sitter,tree-sitter-typescript, andtree-sitter-javascriptpackages from the well-known PyPI registry. These libraries are used for the skill's primary purpose of performing Abstract Syntax Tree (AST) analysis on source code. - [COMMAND_EXECUTION]: The skill utilizes
subprocess.runandos.execvfor several infrastructure and functional tasks: bootstrap.pyusesos.execvto re-execute itself if a newer Python interpreter (3.10+) is found on the system path, ensuring compatibility with its dependencies.session-health-check.pyand other hooks executegitcommands to detect code changes andpipcommands to maintain the skill's execution environment.judge-comments.pyinvokes theclaudeCLI in a restricted mode (no tools, no MCP, single turn) to perform out-of-band analysis of source code comments.- [PRIVILEGE_ESCALATION]: The script
_bootstrap/permissions.pymodifies the agent's platform configuration (settings.jsonorsettings.local.json) to addallowrules for the skill's own Python scripts (bootstrap.pyandreview-files.py). This is an intentional design choice to prevent the agent from prompting the user for permission every time the skill's core scripts are executed. - [DYNAMIC_EXECUTION]: The skill uses
__import__in_bootstrap/dependencies.pyto dynamically check for the presence of required packages before attempting to use them for AST-based code audits.
Audit Metadata