external-pr-ci-trigger
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security vulnerabilities were detected. The skill is authored by DataDog and operates on DataDog's own repositories. It implements the following security controls:
- Input Sanitization: User arguments and data fetched from GitHub (branch names, owners) are validated against restrictive regex patterns (
[a-zA-Z0-9_-]+). - Injection Prevention: The skill explicitly checks for and rejects inputs containing single quotes to prevent breaking out of shell command quoting.
- Least Privilege/Scope: It verifies that the
originremote points specifically toDataDog/salukibefore attempting any push operations, preventing accidental data transfer to unauthorized repositories. - Clean State Enforcement: It checks for a clean working tree and the absence of conflicting local branches/remotes before starting destructive operations.
Audit Metadata