build-api
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses various shell commands to manage version control, project metadata, and build processes.
- Evidence: Extensive usage of
git fetch,gh issue view,gh project item-add,pnpm db:migrate, andpnpm testthroughoutSKILL.md. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external GitHub issues to derive development requirements, which could potentially contain adversarial content designed to influence the agent.
- Ingestion points: Requirement gathering via
gh issue viewinSKILL.md. - Boundary markers: The skill does not provide specific instructions or delimiters to isolate untrusted issue content from the agent's logic.
- Capability inventory: The agent has permissions to write code files, execute build scripts, and perform Git operations.
- Sanitization: No explicit sanitization or validation of the issue title or body is performed before processing.
- [DYNAMIC_EXECUTION]: The skill utilizes
python3 -cto parse and filter JSON output from the GitHub CLI at runtime. - Evidence: Shell blocks in
SKILL.mdpipe command output to inline Python scripts for project board management.
Audit Metadata