fix-dependency-pr

Pass

Audited by Gen Agent Trust Hub on Nov 5, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests data from pull request diffs, CI failure logs, and repository-defined workflow files to identify the cause of failures.
  • Ingestion points: Output from gh run view --log-failed, GitHub Actions workflow YAML files, and pull request diffs.
  • Boundary markers: The skill does not define specific boundary markers for this data, relying instead on a classification process.
  • Capability inventory: The skill can perform git commit, git push, ddev exec, and gh pr comment.
  • Sanitization: The skill requires explicit user review and approval of the proposed fix, diff, and test output before any commit or push occurs.
  • [COMMAND_EXECUTION]: Reproduces build failures by executing shell commands extracted directly from the repository's CI configuration.
  • Evidence: The instructions specify to "Open the failed workflow's YAML to see the exact commands it ran" and then run those commands through DDEV locally to verify fixes.
  • [EXTERNAL_DOWNLOADS]: Fetches patches and issue data from official Drupal community infrastructure.
  • Evidence: The skill uses curl to retrieve content from git.drupalcode.org and www.drupal.org when managing Drupal-specific dependency patches.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 5, 2026, 12:25 AM