validate-delivery

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements standard development workflows for validating task completion, including test execution and build verification.
  • [COMMAND_EXECUTION]: Executes standard toolchain commands such as npm test, pytest, cargo test, and go test based on the project environment detected via manifest files.
  • [DATA_EXPOSURE]: Accesses project manifest files (e.g., package.json, Cargo.toml) and repository state via git stash to evaluate build readiness and test coverage regressions.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from task descriptions and review comments.
  • Ingestion points: task.description and reviewResults in SKILL.md.
  • Boundary markers: None explicitly implemented within the extraction logic.
  • Capability inventory: Shell command execution (npm/pytest/cargo/go) and file system writes via fs.writeFileSync.
  • Sanitization: Employs regular expressions to extract specific patterns (bullet points and numbered lists) from descriptions, which limits the influence of injected instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 02:21 PM
Security Audit — agent-trust-hub — validate-delivery