contributing
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Standard Repository Tooling: The skill uses
pnpmandnodeto execute local validation scripts (e.g.,pnpm run check,node tools/directory-entry-ids). These are routine developer tasks within this specific documentation repository used to maintain content quality. - GitHub Integration: It provides guidance on using the
ghCLI for pull request management, including posting suggestions via the GitHub REST API. The commands use recommended parameterization and standard API endpoints to facilitate peer reviews. - Indirect Prompt Injection Considerations: The documentation review process requires the agent to ingest content from external pull requests via
gh pr diff. This represents a potential vector for indirect prompt injection, which the skill manages by requiring explicit user approval before any changes are committed or pushed to the repository. - Information Security Guidance: The instructions include clear mandates against the inclusion of secrets, credentials, or internal-only data in any part of the repository, reflecting a security-conscious approach to documentation contributions.
Audit Metadata