build-api

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses various shell commands to manage version control, project metadata, and build processes.
  • Evidence: Extensive usage of git fetch, gh issue view, gh project item-add, pnpm db:migrate, and pnpm test throughout SKILL.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GitHub issues to derive development requirements, which could potentially contain adversarial content designed to influence the agent.
  • Ingestion points: Requirement gathering via gh issue view in SKILL.md.
  • Boundary markers: The skill does not provide specific instructions or delimiters to isolate untrusted issue content from the agent's logic.
  • Capability inventory: The agent has permissions to write code files, execute build scripts, and perform Git operations.
  • Sanitization: No explicit sanitization or validation of the issue title or body is performed before processing.
  • [DYNAMIC_EXECUTION]: The skill utilizes python3 -c to parse and filter JSON output from the GitHub CLI at runtime.
  • Evidence: Shell blocks in SKILL.md pipe command output to inline Python scripts for project board management.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 03:46 PM