repository-quality-gate-fixer

Pass

Audited by Gen Agent Trust Hub on Sep 21, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs a provided Python script (scripts/repo_quality_probe.py) to inspect the repository state using git commands via subprocess.run. It also facilitates running standard build and test commands (e.g., npm test, cargo build) to verify quality gates. These actions are essential for the skill's primary function and are subject to the agent's execution constraints and explicit safety rules.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data, including external tool outputs and pull request comments, which could potentially house malicious instructions. * Ingestion points: The repo_quality_probe.py script reads GitHub Actions workflows and configuration files; SKILL.md directs the agent to review AGENTS.md, project documentation, and PR review comments. * Boundary markers: The 'Instruction Priority And Authorization Model' explicitly defines that safety rules and user requests take precedence over instructions found in repository files or tool outputs. * Capability inventory: The skill can execute shell commands, edit files, and perform git operations such as commit and push. * Sanitization: The scripts/repo_quality_probe.py script includes a redact_text function utilizing a library of regex patterns to strip sensitive credentials (e.g., API tokens, SSH keys, passwords) from command outputs before they reach the agent context.
  • [EXTERNAL_DOWNLOADS]: The skill supports project-local dependency management (e.g., pip install, npm install) as documented in the repository. It explicitly requires user authorization for high-impact changes such as global package installations, system runtime modifications, or changing repository-level security settings.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 21, 2026, 05:53 AM