meticulous-review
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external pull request descriptions (via
gh,glab, ortwgtools) and Meticulous test artifacts (DOM diffs, timelines). This data informs the agent's regression analysis. - Ingestion points: Pull request metadata and test artifacts provided in the analysis workflow.
- Boundary markers: There are no explicit delimiters or instructions telling the agent to ignore potentially malicious commands embedded in these external descriptions.
- Capability inventory: The agent can execute commands, manage files, and interact with development platforms.
- Sanitization: No explicit sanitization of external text content is mentioned before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill uses the
meticulousCLI and standard version control tools (git,gh,glab) to perform its review operations. These commands are necessary for the skill's primary function and target vendor-controlled or well-known services. - [EXTERNAL_DOWNLOADS]: The
meticulousCLI fetches screenshot images from the vendor's infrastructure and stores them in a local directory (~/.meticulous/agent-images/) to facilitate visual comparison.
Audit Metadata