ci-verify-setup
Pass
Audited by Gen Agent Trust Hub on Feb 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were detected. The skill uses well-known and trusted GitHub Actions (actions/checkout and oven-sh/setup-bun) to automate a standard development workflow.
- [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection because it must analyze untrusted project configuration files to generate a verification pipeline.
- Ingestion points: The agent reads existing scripts and metadata from files such as package.json and lockfiles.
- Boundary markers: No explicit markers are used to isolate untrusted project data from instructions.
- Capability inventory: The skill is capable of modifying local project files and executing a generated 'verify' script.
- Sanitization: The skill does not explicitly sanitize or validate the contents of existing scripts before incorporating them into the verify command.
Audit Metadata