marketplace-health-check
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands and vendor-provided scripts to audit the repository environment.
- Evidence: Uses standard tools such as
gh,grep,find,jq, andgitfor repository analysis inSKILL.mdandscripts/repo-health-check.workflow.js. - Evidence: Executes maintenance scripts located within the vendor's directory, specifically
daymade-claude-code/marketplace-dev/scripts/check_marketplace.shandcheck_doc_skill_lists.py.- [PROMPT_INJECTION]: The skill processes potentially untrusted content from GitHub Pull Requests and Issues, creating a surface for indirect injection. - Ingestion points: Fetches data via
gh pr list,gh issue list,gh pr view, andgh issue viewinscripts/repo-health-check.workflow.js. - Boundary markers: Agents are constrained by dimension-specific prompts and a strict JSON schema (
CHECK_SCHEMA) for their output. - Capability inventory: The agents have access to shell utilities (
grep,find) and the repository's files. - Sanitization: The skill incorporates a robust "Counter-Review" methodology as described in
SKILL.mdandreferences/health-check-methodology.md, requiring the agent to independently verify and validate findings before reporting them to the user to prevent the relaying of noise or malicious instructions embedded in the analyzed data.
Audit Metadata