drupal-ai-contrib
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents the installation of the
drupalorgCLI tool by downloading a PHAR file from themglaman/drupalorg-clirepository on GitHub. - [COMMAND_EXECUTION]: The skill utilizes shell commands including
drupalorg,glab, andgitto interact with project repositories and external APIs. - [PRIVILEGE_ESCALATION]: Installation instructions for the required CLI tool involve changing file permissions (
chmod +x) and moving the binary to a system directory (/usr/local/bin). - [INDIRECT_PROMPT_INJECTION]: The skill processes project issues and merge requests from external APIs, creating an attack surface for indirect prompt injection. Ingestion points: Fetches issue summaries, project metadata, and merge request details from
drupal.organd GitLab. Boundary markers: The skill relies on 'evidence over assertion' but lacks explicit prompt delimiters for external content. Capability inventory: Executes CLI tools and performs GitLab API writes based on external issue data. Sanitization: Requires the agent to validate issue IDs and project names using specific regular expressions before shell execution.
Audit Metadata