meticulous-review

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external pull request descriptions (via gh, glab, or twg tools) and Meticulous test artifacts (DOM diffs, timelines). This data informs the agent's regression analysis.
  • Ingestion points: Pull request metadata and test artifacts provided in the analysis workflow.
  • Boundary markers: There are no explicit delimiters or instructions telling the agent to ignore potentially malicious commands embedded in these external descriptions.
  • Capability inventory: The agent can execute commands, manage files, and interact with development platforms.
  • Sanitization: No explicit sanitization of external text content is mentioned before it is processed by the agent.
  • [COMMAND_EXECUTION]: The skill uses the meticulous CLI and standard version control tools (git, gh, glab) to perform its review operations. These commands are necessary for the skill's primary function and target vendor-controlled or well-known services.
  • [EXTERNAL_DOWNLOADS]: The meticulous CLI fetches screenshot images from the vendor's infrastructure and stores them in a local directory (~/.meticulous/agent-images/) to facilitate visual comparison.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 02:13 AM