hotchocolate-fix-bug
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub issue reports (snippets, descriptions, and linked repositories). It mitigates this risk with explicit security instructions requiring the agent to never execute or clone untrusted reproduction code, and instead requires manual reconstruction of minimal test cases.
- [COMMAND_EXECUTION]: The skill uses the
gh(GitHub CLI),nitro(vendor knowledge management tool), anddotnetCLI tools. These executions are scoped to the specificChilliCream/graphql-platformrepository and standard development workflows. - [EXTERNAL_DOWNLOADS]: Fetches issue data from the official
ChilliCream/graphql-platformGitHub repository. These operations are performed via established tools and target well-known, trusted project infrastructure. - [SAFE]: The skill refers users to the official vendor documentation at
https://chillicream.com/docs/nitro/cli/installationfor tool setup and correctly instructs the agent not to attempt unauthorized installations.
Audit Metadata