flathub-maintenance
Pass
Audited by Gen Agent Trust Hub on May 8, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard development tools (git, flatpak-builder, npm, gh, and appstreamcli) for their intended purposes in a software maintenance lifecycle.
- [EXTERNAL_DOWNLOADS]: Fetches configuration and build manifests from the official Flathub organization's GitHub repositories, which is a well-known service and necessary for the documented workflow.
- [PROMPT_INJECTION]: An indirect prompt injection surface is present as the skill instructs the agent to ingest and analyze external data from Flathub PR comments and Vorarbeiter build logs for troubleshooting.
- Ingestion points: Flathub Pull Request comments and Vorarbeiter CI build logs (referenced in the 'Diagnosis Workflow' section).
- Boundary markers: No specific delimiters are defined for the agent to isolate log data from instructions.
- Capability inventory: The skill can perform git operations (commit, push), interact with the GitHub CLI (pr create), and execute local build scripts.
- Sanitization: Content from logs is not explicitly sanitized, but the workflow is inherently scoped to maintenance tasks.
- [DATA_EXPOSURE]: Provides guidance on managing GitHub repository secrets (specifically FLATHUB_TOKEN) using standard secure practices for CI/CD automation.
Audit Metadata