release-train-runner

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFEPROMPT_INJECTIONDATA_EXFILTRATIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it merges code from external pull requests and subsequently executes that code in a remote environment during testing. \n
  • Ingestion points: Pull request branches are fetched and merged in stages/03-validate-integrate/CONTEXT.md.\n
  • Boundary markers: Absent. The skill does not use specific delimiters or instructions to ignore potential commands embedded in the merged code.\n
  • Capability inventory: The skill can execute shell commands on remote compute via git merge and <TEST_COMMAND> calls in stages/03-validate-integrate/CONTEXT.md.\n
  • Sanitization: Absent. The skill performs no validation or filtering of the code content before merging or testing.\n- [DATA_EXFILTRATION]: The skill accesses a sensitive .env file located at $HOME/projects/fellowship-dev/claude-buddy/.env to retrieve a CODESPACE_TOKEN. While this is a vendor-owned resource path for the author 'fellowship-dev', accessing configuration files that contain secrets is a security-sensitive operation.\n- [COMMAND_EXECUTION]: The skill performs command execution on remote environments via a $REMOTE_EXEC abstraction. It runs git operations and arbitrary test commands as defined in the repository's configuration, which is necessary for release validation.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests to a worker management API (${PYLOT_API}) and uses the GitHub CLI (gh) for repository operations. It handles a dispatch token for authorization when calling the worker API.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 10:56 PM
Security Audit — agent-trust-hub — release-train-runner