fcode-release
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
fcodeCLI tool to manage application workspaces, specifically for cloning, adding remotes, pulling metadata, and pushing code. These actions are standard for the tool's intended deployment and release management purpose. - [INDIRECT_PROMPT_INJECTION]: The skill reads an external
APP_VALIDATION_REPORT.mdfile to verify the health of the application before promotion. While this represents a data ingestion surface, the skill includes explicit instructions for the agent to seek user confirmation and provides logic to block automated actions if the report contains failures. - Ingestion points:
APP_VALIDATION_REPORT.mdreferenced in the validation gate procedure. - Boundary markers: None explicitly defined for the validation report content.
- Capability inventory: Workspace management and code deployment via
fcode(clone, pull, push). - Sanitization: The skill relies on specific keywords (e.g., "Blockers") to parse the report rather than raw content interpolation.
Audit Metadata