pre-deploy
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill automates the execution of local build and linting toolchains within the project directory.
- Evidence: It uses
Bun.spawnto run commands likenpm run build,cargo build --release,poetry build, andpython -m compileallacross thescripts/build-run.mjsandscripts/lint-check.mjsfiles. These commands are standard for the skill's purpose of verifying deployment readiness. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of logs and error messages generated by local build tools to diagnose failures and suggest fixes.
- Ingestion points: Captured stdout and stderr from toolchain commands executed via
Bun.spawninscripts/build-run.mjsandscripts/lint-check.mjs. - Boundary markers: The skill utilizes specific instructional blocks (e.g.,
<instruction_contract>,<workflow>,<argument_validation>) to establish operational constraints and safety boundaries. - Capability inventory: The skill relies on the
Bash,Write,Edit, andTodoWritetools to modify project files and re-run validation checks. - Sanitization: No explicit sanitization or filtering of log content is implemented; the agent is instructed to use structured reasoning and focus strictly on reproduced failures to mitigate risk.
- [DYNAMIC_EXECUTION]: The orchestration scripts dynamically assemble shell commands based on the detected project stack and package manager.
- Evidence: Functions like
nodeScriptCommandinscripts/lint-check.mjsandbuildCommandinscripts/build-run.mjsconstruct command arrays at runtime based on the presence of specific configuration files (e.g.,package-lock.json,Cargo.toml). This is a standard automation pattern for development environments.
Audit Metadata