build-in-public
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses platform-integrated tools (linear, gh, git, devsql) to access project metadata and development logs. Access is restricted to the user's authenticated scope.
- [SAFE]: A manual review gate is enforced; the skill is instructed never to post updates automatically, leaving final validation and distribution to the user.
- [SAFE]: Indirect Prompt Injection Risk Assessment:
- Ingestion points: The skill processes external content from Linear issues, GitHub pull requests, and Git commit logs (SKILL.md).
- Boundary markers: While no explicit data delimiters are used, the output format is limited to a text draft for the user.
- Capability inventory: The skill can only query project status and local session history; it lacks capabilities for persistent storage, file modification, or outbound network calls to arbitrary domains.
- Sanitization: Data is transformed through summarization and synthesis into a specific update format, which provides an inherent layer of abstraction from source inputs.
- Risk evaluation: The overall risk is low because the agent's actions are confined to text generation for human approval.
Audit Metadata