lcx-contribute-bug-fix
Pass
Audited by Gen Agent Trust Hub on Aug 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to automate development workflows, including
gitfor version control,gh(GitHub CLI) for repository interactions and PR management, andnodeto run a local utility script. - [EXTERNAL_DOWNLOADS]: The skill clones source code from external repositories on GitHub, specifically
code-yeongyu/lazycodexandopenai/codex. These downloads are central to the skill's purpose of bug fixing. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of user-provided bug reports and source code from repositories. This data is incorporated into GitHub issues and PR bodies.
- Ingestion points: User bug reports and source code from
code-yeongyu/lazycodexandopenai/codex(SKILL.md). - Boundary markers: The skill uses Markdown templates and headers to delimit different sections of the contribution body.
- Capability inventory: The agent has access to
git,gh,node, and filesystem operations (rm,mktemp) via shell execution. - Sanitization: The bundled Node.js script
scripts/create-pr-body.mjsvalidates the structure of the PR data but does not perform specific sanitization of the content for Markdown or instruction injection.
Audit Metadata