ext-triage-js
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is designed to triage and act upon untrusted data from automated PR review comments provided by various external services such as gemini-code-assist, Copilot, and Sonar.\n
- Ingestion points: Automated review comments from third-party bots are processed as input for decision-making in
standards/pr-comment-disposition.md.\n - Boundary markers: The instructions state that all comments must first pass a "validity check from persona-plan-marshall-agent" and be verified against the plan's intent before any disposition is made.\n
- Capability inventory: The triage process can lead to the
FIXoutcome, which involves modifying the codebase and committing changes. The skill also guides the execution of linting tools that modify files.\n - Sanitization: The skill mandates the use of a "PR review hard rule" to validate suggestions against the driving project plan and existing architectural lessons to prevent the adoption of malicious or erroneous suggestions.\n- [COMMAND_EXECUTION]: The skill includes instructions for running standard JavaScript ecosystem tools for automated remediation.\n
- Evidence:
standards/severity.mdlists commands such asnpx eslint --fix .andnpx prettier --write .to fix identified issues. These are standard development practices and are used within their intended functional scope.
Audit Metadata