pre-publish-review
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard git and npm commands to analyze local changes (e.g.,
git log,git diff,npm view). These are benign developer tools used as intended for pre-release verification. - [DATA_EXPOSURE]: The skill reads local file contents and git metadata to provide context for review agents. While this involves data access, the data is confined to the agentic environment for the purpose of the requested code review and is not exfiltrated to external third-party domains.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of git diffs and commit messages into LLM prompts. However, it implements strong boundary markers by wrapping content in XML-like tags (e.g.,
<diff>,<commits>) and provides clear behavioral instructions to the reviewer agents, significantly reducing the risk of unintended instruction execution.
Audit Metadata