bruno-ci-setup
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill includes explicit safety instructions to treat repository files and collection contents as untrusted data rather than instructions. It directs the agent to ignore any commands embedded within processed materials.
- [DATA_EXFILTRATION]: No exfiltration patterns were detected. The skill emphasizes best practices for handling sensitive data, such as using CI-native secret management and avoiding the inclusion of secrets in logs, reports, or committed files.
- [COMMAND_EXECUTION]: The provided Python scripts use subprocess.run for functional tasks like resolving official release tags via git ls-remote and executing internal test suites. These operations are performed with static or validated arguments and do not present a command injection risk.
- [EXTERNAL_DOWNLOADS]: The skill queries the official npm registry and the official Bruno GitHub repository to resolve the latest tool versions. These network requests are used solely for version pinning and target well-known, trusted infrastructure.
Audit Metadata