forge
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell and Python scripts for administrative tasks such as setting up GitHub labels and validating the technical specification against a predefined schema. These scripts are included in the skill's own directory.
- [EXTERNAL_DOWNLOADS]: Research capabilities are supported through the use of WebFetch and the GitHub CLI to retrieve content from external URLs and issues, facilitating data-driven decision-making. These operations are essential for the skill's stated purpose.
- [PROMPT_INJECTION]: The skill processes content from potentially untrusted external sources like web pages and GitHub issues. This creates an indirect prompt injection surface; however, the skill explicitly provides templates and instructions for wrapping such data in XML tags within subagent prompts to prevent the content from being interpreted as instructions.
Audit Metadata