release-train-runner
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it merges code from external pull requests and subsequently executes that code in a remote environment during testing. \n
- Ingestion points: Pull request branches are fetched and merged in
stages/03-validate-integrate/CONTEXT.md.\n - Boundary markers: Absent. The skill does not use specific delimiters or instructions to ignore potential commands embedded in the merged code.\n
- Capability inventory: The skill can execute shell commands on remote compute via
git mergeand<TEST_COMMAND>calls instages/03-validate-integrate/CONTEXT.md.\n - Sanitization: Absent. The skill performs no validation or filtering of the code content before merging or testing.\n- [DATA_EXFILTRATION]: The skill accesses a sensitive
.envfile located at$HOME/projects/fellowship-dev/claude-buddy/.envto retrieve aCODESPACE_TOKEN. While this is a vendor-owned resource path for the author 'fellowship-dev', accessing configuration files that contain secrets is a security-sensitive operation.\n- [COMMAND_EXECUTION]: The skill performs command execution on remote environments via a$REMOTE_EXECabstraction. It runs git operations and arbitrary test commands as defined in the repository's configuration, which is necessary for release validation.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests to a worker management API (${PYLOT_API}) and uses the GitHub CLI (gh) for repository operations. It handles a dispatch token for authorization when calling the worker API.
Audit Metadata