safely-merge-dependabots
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill describes a legitimate and security-focused workflow for managing dependency updates. It incorporates comprehensive safety checks, including semantic versioning analysis, automated test execution in isolated environments, and CVE verification.\n- [COMMAND_EXECUTION]: The skill mentions a 'test-runner' agent that executes the project's test suite. This is a standard and necessary part of the 'safe merge' process, intended to verify that updates do not break the existing codebase. The instructions specify that this happens in an isolated worktree, which is a security best practice for such operations.\n- [PROMPT_INJECTION]: While the skill processes external data in the form of Dependabot PRs (Ingestion points), the workflow is designed with a 'safe default' (Sanitization) where any worker failure or detected risk results in a skip rather than a merge (Capability inventory). This multi-layered analysis by specialized agents reduces the surface area for indirect prompt injection from PR metadata, even in the absence of explicit boundary markers.
Audit Metadata