dot-release-rollback-check
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes git log, git fetch, and gh pr list to retrieve repository history and metadata. Shell variables for these commands are derived from version strings that are validated against a strict regex pattern (\d{2}.\d{2}.\d{2}-\d+_[0-9a-f]+), mitigating command injection risks.
- [EXTERNAL_DOWNLOADS]: Fetches PR metadata and labels from GitHub, a well-known service. These operations are restricted to the official dotCMS/core repository.
- [DYNAMIC_EXECUTION]: Uses a hardcoded Python script to parse git logs and extract PR numbers. The script is static and included within the instructions, ensuring no external or untrusted code is executed at runtime.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests PR titles and labels from an external source (GitHub). While it lacks explicit boundary markers when displaying this data in the report, the attack surface is limited as command-line arguments are sanitized through regex validation and integer casting before use in subsequent tools.
Audit Metadata