contribution-submit
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes several command-line tools to manage the contribution workflow, including
git diffto check for changes,git pushto update branches, andglabfor GitLab API interactions. It also utilizes local helper scripts located in the plugin directory (reverify-list.shandreview-mark.sh) to validate the state of the contribution. - [EXTERNAL_DOWNLOADS]: The skill relies on external CLI tools
glab(GitLab CLI) anddrupalorg-cli. These are standard tools within the Drupal development ecosystem used for interacting with official project repositories and issue queues. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a potential attack surface for indirect prompt injection as it processes external, untrusted data.
- Ingestion points: Reads output from
git diff(representing changed code in an issue fork) and fetches live policy data via thedrupal-ai-contrib:ai-policy-checkeragent. - Boundary markers: The instructions do not specify explicit delimiters for the data interpolated into prompts.
- Capability inventory: The skill has the capability to write to repositories (
git push), create merge requests (glab api), and update issue statuses on Drupal.org. - Sanitization: The skill implements mitigation by validating key identifiers (Issue IDs and project machine-names) against strict regular expression patterns (
^[0-9]+$and^[a-z][a-z0-9_]*$) before interpolation.
Audit Metadata