fix-dependency-pr
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from pull request diffs, CI failure logs, and repository-defined workflow files to identify the cause of failures.
- Ingestion points: Output from
gh run view --log-failed, GitHub Actions workflow YAML files, and pull request diffs. - Boundary markers: The skill does not define specific boundary markers for this data, relying instead on a classification process.
- Capability inventory: The skill can perform
git commit,git push,ddev exec, andgh pr comment. - Sanitization: The skill requires explicit user review and approval of the proposed fix, diff, and test output before any commit or push occurs.
- [COMMAND_EXECUTION]: Reproduces build failures by executing shell commands extracted directly from the repository's CI configuration.
- Evidence: The instructions specify to "Open the failed workflow's YAML to see the exact commands it ran" and then run those commands through DDEV locally to verify fixes.
- [EXTERNAL_DOWNLOADS]: Fetches patches and issue data from official Drupal community infrastructure.
- Evidence: The skill uses
curlto retrieve content fromgit.drupalcode.organdwww.drupal.orgwhen managing Drupal-specific dependency patches.
Audit Metadata