contribute-to-eliza
Pass
Audited by Gen Agent Trust Hub on Aug 22, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/live-report.mjsutility usesspawnSyncto execute the GitHub CLI (gh) for gathering an inventory of issues and pull requests. The command arguments are constructed using sanitized repository identifiers and fixed API flags, representing a legitimate use of development tools. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from GitHub (issue bodies, PR diffs, and comments). It explicitly addresses this risk by instructing the agent to treat all such content as data rather than instructions, and requires a strict isolation boundary (containers or VMs) for any runtime execution or testing of pull request content.
Audit Metadata