greploop 監査レポート.

警告

• Permission surface may require sandboxing
• The SKILL.md does not explicitly describe how to fetch the list of unresolved review comments or how to extract the Greptile confidence score from the review output. This is a critical step in the loop (fixing actionable comments) but is left implicit.
• Inputs (PR/MR/CL number, max iterations) are used in shell commands without explicit quoting or validation guidance. An agent following the instructions literally could be vulnerable to command injection if the inputs are maliciously crafted.
• Quality score needs review
• Permission surface needs review: shell or command execution, filesystem or document access
• Permission surface: shell or command execution, filesystem or document access

方法

このレポートは公開メタデータ、AI レビュー、リポジトリの鮮度、インストール準備、OpenAgentSkill イベント、品質スコア、信頼チェック、Agent セーフティゲートを統合します。完全なソースコード監査ではありません。