flathub-maintenance

Pass

Audited by Gen Agent Trust Hub on May 8, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes standard development tools (git, flatpak-builder, npm, gh, and appstreamcli) for their intended purposes in a software maintenance lifecycle.
  • [EXTERNAL_DOWNLOADS]: Fetches configuration and build manifests from the official Flathub organization's GitHub repositories, which is a well-known service and necessary for the documented workflow.
  • [PROMPT_INJECTION]: An indirect prompt injection surface is present as the skill instructs the agent to ingest and analyze external data from Flathub PR comments and Vorarbeiter build logs for troubleshooting.
  • Ingestion points: Flathub Pull Request comments and Vorarbeiter CI build logs (referenced in the 'Diagnosis Workflow' section).
  • Boundary markers: No specific delimiters are defined for the agent to isolate log data from instructions.
  • Capability inventory: The skill can perform git operations (commit, push), interact with the GitHub CLI (pr create), and execute local build scripts.
  • Sanitization: Content from logs is not explicitly sanitized, but the workflow is inherently scoped to maintenance tasks.
  • [DATA_EXPOSURE]: Provides guidance on managing GitHub repository secrets (specifically FLATHUB_TOKEN) using standard secure practices for CI/CD automation.
Audit Metadata
Risk Level
SAFE
Analyzed
May 8, 2026, 04:17 PM