Confirm the source
Compare the repository, publisher, and installation command before continuing.
!
Third-party audit
ReviewGen Agent Trust Hub
code-reviewer · google-gemini/gemini-cli
Provider summary
The skill executes 'npm run preflight', which runs arbitrary code defined in the repository being reviewed. This poses a risk if reviewing untrusted Pull Requests. It also lacks boundaries to prevent indirect prompt injection from PR comments or code.
The provider classified the analyzed snapshot as MEDIUM risk. This result applies to the content available at audit time.
- Provider
- Gen Agent Trust Hub
- Normalized result
- warn
- Risk level
- MEDIUM
- Audited
- Feb 17, 2026
How to use this signal
Read the content
Review SKILL.md, scripts, and allowed tools. Artificial Atlas never executes them during indexing.
Limit permissions
Use the narrowest possible scope and avoid broad credentials for third-party skills.