repository-governance-lifecycle

Pass

Audited by Gen Agent Trust Hub on Sep 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill directs the agent to use common system and development tools, such as ln for creating symbolic links between documentation files and pnpm for managing changesets. It also refers to the steward CLI tool for auditing claims and verifying evidence artifacts within the repository.
  • [EXTERNAL_DOWNLOADS]: The skill is installed via npx from the npm registry and references branding assets and status badges hosted on the vendor's official GitHub repository. These downloads are performed from well-known and trusted service providers.
  • [INDIRECT_PROMPT_INJECTION]: The governance process involves reading repository documentation, such as existing ADRs and design plans, to generate new living documentation. The skill includes specific instructions to audit these inputs against the foundational repository charter and ethical guidelines to ensure consistency.
  • [DYNAMIC_EXECUTION]: A Node.js one-liner is provided as a helper for cleaning and base64-encoding SVG files for use in repository badges. This snippet performs local file operations and string manipulation for branding purposes.
  • [SAFE]: All identified command executions, downloads, and data processing activities are consistent with the skill's intended purpose of repository stewardship. The skill explicitly bans hidden scripts and promotional hype, prioritizing transparency and human craftsmanship.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 25, 2026, 08:38 AM