contribution-submit

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes several command-line tools to manage the contribution workflow, including git diff to check for changes, git push to update branches, and glab for GitLab API interactions. It also utilizes local helper scripts located in the plugin directory (reverify-list.sh and review-mark.sh) to validate the state of the contribution.
  • [EXTERNAL_DOWNLOADS]: The skill relies on external CLI tools glab (GitLab CLI) and drupalorg-cli. These are standard tools within the Drupal development ecosystem used for interacting with official project repositories and issue queues.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection as it processes external, untrusted data.
  • Ingestion points: Reads output from git diff (representing changed code in an issue fork) and fetches live policy data via the drupal-ai-contrib:ai-policy-checker agent.
  • Boundary markers: The instructions do not specify explicit delimiters for the data interpolated into prompts.
  • Capability inventory: The skill has the capability to write to repositories (git push), create merge requests (glab api), and update issue statuses on Drupal.org.
  • Sanitization: The skill implements mitigation by validating key identifiers (Issue IDs and project machine-names) against strict regular expression patterns (^[0-9]+$ and ^[a-z][a-z0-9_]*$) before interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 12:40 PM