coding-standards
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill manages the automated installation of necessary third-party libraries during the bootstrap phase.\n
- Evidence:
_bootstrap/install.pyutilizespip installto download and installtree-sitterand its specific language grammars (tree-sitter-typescript,tree-sitter-javascript) from the Python Package Index (PyPI).\n- [COMMAND_EXECUTION]: The skill utilizes several system-level execution patterns for configuration management and code analysis.\n - Evidence:
bootstrap.pyemploysos.execvfor process replacement, ensuring the skill's setup runs under a compatible Python version.\n - Evidence: Multiple components, including
_bootstrap/readiness.py,hooks/session-health-check.py, andhooks/_comment_judge.py, usesubprocess.runto callgit,python,pip, and theclaudeCLI.\n - Evidence:
_bootstrap/permissions.pyprogrammatically addsBashallow-rules to the agent'ssettings.local.jsonto pre-approve the execution of its own linter and installer scripts, avoiding manual user prompts for these specific commands.\n- [DATA_EXFILTRATION]: The skill facilitates the evaluation of local workspace content by an external model service.\n - Evidence:
hooks/judge-comments.pyextracts source code comments from files modified in a session and transmits them to an Anthropic model via theclaudeCLI to judge their adherence to prose standards.\n- [SAFE]: All identified activities are consistent with the skill's primary and documented purpose as a coding standards enforcement tool.\n - Evidence: External downloads and tool references target established and trusted organizations and registries.\n
- Evidence: The separate model calls used for comment evaluation are strictly sandboxed with tools disabled and a single-turn limit.
Audit Metadata