bug-to-patch-generator
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions and code snippets in Python and JavaScript for executing shell commands to run tests (Step 4). This capability is used to validate that generated patches fix the reported bug without introducing regressions. The code utilizes
subprocess.runandexecSyncfor this purpose. - [PROMPT_INJECTION]: The skill processes untrusted data from bug reports to identify root causes and generate fixes. While this creates an attack surface for indirect prompt injection, the risk is mitigated by the structured parsing approach and the requirement for human review of generated patches.
- [EXTERNAL_DOWNLOADS]: The JavaScript validation logic includes a command to install project dependencies using
npm ci. This fetches packages from the official npm registry. The skill correctly includes the--ignore-scriptsflag to prevent the execution of potentially malicious scripts during the installation process.
Audit Metadata