validate-delivery
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements standard development workflows for validating task completion, including test execution and build verification.
- [COMMAND_EXECUTION]: Executes standard toolchain commands such as
npm test,pytest,cargo test, andgo testbased on the project environment detected via manifest files. - [DATA_EXPOSURE]: Accesses project manifest files (e.g.,
package.json,Cargo.toml) and repository state viagit stashto evaluate build readiness and test coverage regressions. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from task descriptions and review comments.
- Ingestion points:
task.descriptionandreviewResultsinSKILL.md. - Boundary markers: None explicitly implemented within the extraction logic.
- Capability inventory: Shell command execution (npm/pytest/cargo/go) and file system writes via
fs.writeFileSync. - Sanitization: Employs regular expressions to extract specific patterns (bullet points and numbered lists) from descriptions, which limits the influence of injected instructions.
Audit Metadata