contributing

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • Standard Repository Tooling: The skill uses pnpm and node to execute local validation scripts (e.g., pnpm run check, node tools/directory-entry-ids). These are routine developer tasks within this specific documentation repository used to maintain content quality.
  • GitHub Integration: It provides guidance on using the gh CLI for pull request management, including posting suggestions via the GitHub REST API. The commands use recommended parameterization and standard API endpoints to facilitate peer reviews.
  • Indirect Prompt Injection Considerations: The documentation review process requires the agent to ingest content from external pull requests via gh pr diff. This represents a potential vector for indirect prompt injection, which the skill manages by requiring explicit user approval before any changes are committed or pushed to the repository.
  • Information Security Guidance: The instructions include clear mandates against the inclusion of secrets, credentials, or internal-only data in any part of the repository, reflecting a security-conscious approach to documentation contributions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 04:04 PM
Security Audit — agent-trust-hub — contributing