run-codex-review
Pass
Audited by Gen Agent Trust Hub on May 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several Python scripts to orchestrate a complex git workflow, including worktree management (
git worktree), commit manipulation (git rebase), and GitHub interaction via theghCLI. These operations are performed using safe subprocess calls with arguments passed as lists. - [EXTERNAL_DOWNLOADS]: The
spawn-review-worktrees.pyscript provides an optional--prep-depsfeature that automatically installs project dependencies from standard, well-known package registries (e.g., NPM, PyPI) using the project's own lockfiles. - [SAFE]: The skill includes explicit security controls to prevent the automatic application of potentially malicious review feedback. It mandates that all review items must be evaluated by the
/do-reviewskill before any changes are committed, providing a strong defense against potential indirect prompt injection from external review sources.
Audit Metadata