Trust Score for River Review
Trust Score 72 out of 100. Security label: caution. Computed with methodology version 2026-10-21. A scan is not a safety guarantee.
Component scores
| Component | Score | Weight | Points |
|---|---|---|---|
| Security | 64 | 40% | 25.6 |
| Provenance | 70 | 20% | 14.0 |
| Installability | 64 | 15% | 9.6 |
| MCP posture | 100 | 10% | 10.0 |
| Publisher | 75 | 10% | 7.5 |
| Maintenance | 100 | 5% | 5.0 |
How the total is reached
- Weighted sum of the components: 71.7.
- No cap applies.
- No adjustments apply.
- Result: 72.
Security scan
- Scanner: static fallback scan, not a live exploit test.
- Listing last updated 2026-10-15 (11 days ago).
- Findings: 139, of which 0 high or critical.
- Security checks in the source CI: maintained, checked 2026-10-15.
| Severity | Finding | Path |
|---|---|---|
| medium | Referenced asset is missing from the plugin package. | assets/icon.svg |
| medium | privacyPolicyURL should be present for marketplace readiness. | .codex-plugin/plugin.json |
| medium | termsOfServiceURL should be present for marketplace readiness. | .codex-plugin/plugin.json |
| info | Cisco skill scanner timed out after 60000 ms | .claude/skills/ask-codex |
| info | Cisco skill scanner timed out after 60000 ms | .claude/skills/river-review-discipline |
| info | Cisco skill scanner timed out after 60000 ms | .claude/skills/skill-creator |
| info | Cisco skill scanner timed out after 60000 ms | .claude/skills/skill-ops-planner |
| info | Cisco skill scanner timed out after 60000 ms | .claude/skills/skill-optimizer |
| info | Script permission declarations are required for scripts/: scripts/templates/skill/README.md, scripts/templates/skill/SKILL.md, scripts/templates/skill/prompt/system.md, scripts/templates/skill/skill.yaml, scripts/templates/skill/prompt/user.md, scripts/templates/skill/eval/promptfoo.yaml | scripts/templates/skill |
| info | Cisco skill scanner timed out after 60000 ms | skills/agent-skills/adversarial-review |
| info | Cisco skill scanner exited with code 1: Error loading skill: No SKILL.md and no .md files found in /tmp/hol-skill-safety-fR7MrA (lenient mode requires at least one markdown file) | skills/agent-skills/review-team |
| info | Cisco skill scanner exited with code 1: Error loading skill: No SKILL.md and no .md files found in /tmp/hol-skill-safety-oi5szh (lenient mode requires at least one markdown file) | skills/agent-skills/river-review |
| info | Cisco skill scanner timed out after 60000 ms | skills/agent-skills/river-review-architecture |
| info | Cisco skill scanner timed out after 60000 ms | skills/agent-skills/river-review-code |
| info | Cisco skill scanner timed out after 60000 ms | skills/agent-skills/river-review-docs |
| info | Cisco skill scanner exited with code 1: Error loading skill: No SKILL.md and no .md files found in /tmp/hol-skill-safety-OiomI3 (lenient mode requires at least one markdown file) | skills/agent-skills/river-review-frontend |
| info | Cisco skill scanner timed out after 60000 ms | skills/agent-skills/river-review-performance |
| info | Cisco skill scanner timed out after 60000 ms | skills/agent-skills/river-review-security |
| info | Cisco skill scanner exited with code 1: Error loading skill: No SKILL.md and no .md files found in /tmp/hol-skill-safety-xpDuFC (lenient mode requires at least one markdown file) | skills/agent-skills/river-review-security-audit |
| info | Cisco skill scanner timed out after 60000 ms | skills/agent-skills/river-review-testing |
| info | Cisco skill scanner exited with code 1: Error loading skill: No SKILL.md and no .md files found in /tmp/hol-skill-safety-Bue2wp (lenient mode requires at least one markdown file) | skills/agent-skills/unknown-coverage-review |
| info | Cisco skill scanner timed out after 60000 ms | skills/downstream/coverage-gap |
| info | Cisco skill scanner timed out after 60000 ms | skills/downstream/flaky-test |
| info | Cisco skill scanner exited with code 1: Error loading skill: No SKILL.md and no .md files found in /tmp/hol-skill-safety-OC6gkf (lenient mode requires at least one markdown file) | skills/downstream/gha-workflow-security |
| info | Cisco skill scanner exited with code 1: Error loading skill: No SKILL.md and no .md files found in /tmp/hol-skill-safety-12VcC2 (lenient mode requires at least one markdown file) | skills/downstream/review-policy-standard-downstream |
Showing 25 of 139 findings, most severe first.
Think a finding, or a HOL Guard warning about this plugin, is wrong? Report a false positive to the HOL Guard maintainers.
Ownership and provenance evidence
- Source commit pinned: Yes
- Manifest digest verified: Yes
- Domain proof: No
- Publisher verified: No
- Owner verified on HOL: No
- Checked release: None recorded. A release is checked when the repository runs the HOL plugin release workflow.
GitHub activity
- Stars: 7
- Forks: 0
- Open issues: 35
- Last push: 2026-10-13
Fetched 2026-10-14. GitHub activity is context only and is not part of the Trust Score.
Attested installs: Fewer than 10 attested installs of this plugin in week 2026-W43, so no number is shown. Attested installs come from opt-in HOL Guard install reports, counted once per machine and runtime each week, and no number is shown below 10. Setup answers from visitors, GitHub stars and download counts from other directories are claims HOL cannot check, so they are labelled separately and never added in. Like GitHub activity, they are not part of the Trust Score.
Score history
| Recorded | Trust Score |
|---|---|
| 72 |
A row appears when the reported score changes. Dates are when HOL recorded the score, not when the scan ran.
Request approval from your security team
Copy a short request that links this evidence. Copying sends nothing to HOL.
Preview the text
Approval request: River Review (agent plugin) I would like to use this plugin. HOL publishes this evidence for it: - Trust Score: 72 out of 100 - Security label: caution (139 findings, 0 high or critical) - Source: https://github.com/s977043/river-review - Trust Score breakdown: https://hol.org/registry/plugins/river-review-maintainers%2Friver-review/trust - Recorded releases: https://hol.org/registry/plugins/river-review-maintainers%2Friver-review/releases - Methodology (version 2026-10-21): https://hol.org/plugins/trust-score A scan reads source files and manifests and does not run the plugin; it is not a safety guarantee. HOL Guard can enforce the team's decision on each developer machine: https://hol.org/guard
Limitations
The scan reads source files and manifests; it does not run the plugin. Score history starts on 23 October 2026 and covers the listings HOL records daily. Memberships, paid placements and upvotes are not inputs. See the full methodology for every rule, the versions HOL has recorded, or go back to River Review.