Skills
skills/andiedie/skills/and-workflow-contract/Gen Agent Trust Hub

and-workflow-contract

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill is designed to ingest and act upon data from GitHub issues (bodies, comments, and labels). \n
  • Ingestion points: Instructions in SKILL.md and wayfinding.md direct the agent to read ## State Reason, ## Implementation, and ## Deployment Manifest blocks from issue comments.\n
  • Boundary markers: The skill relies on specific Markdown headers and structural conventions (e.g., <!-- and-investigation:<key> -->) to delimit workflow metadata.\n
  • Capability inventory: The agent is empowered to call the GitHub API via the gh CLI to mutate issue state, labels, and relationships (relationship-api.md).\n
  • Sanitization: The contract includes "Sweep Checks" (sweep-checks.md) and "Invariants" to detect and report "drift" (inconsistent or malformed state data), providing validation against malformed metadata.\n- [COMMAND_EXECUTION]: The relationship-api.md file contains template shell commands for the GitHub CLI (gh). \n
  • Evidence: The skill provides recipes for REST API calls (gh api --method POST ...) to manage sub-issues and dependencies. These commands are constrained to the GitHub platform and use standardized headers (X-GitHub-Api-Version).
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 02:32 AM
Security Audit — agent-trust-hub — and-workflow-contract