integrate-with-gcx
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local binaries and development tools including
bin/gcx,mise,go,git, andgrep. These tools are used for building the project (mise run build), running tests (go test), and performing code analysis (grep) as part of the integration and review workflow. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it is designed to ingest and analyze untrusted content from the repository.
- Ingestion points: The agent reads repository files such as
AGENTS.md,docs/plans/,internal/source files, and project documentation in thereferences/directory. - Boundary markers: There are no explicit delimiters or instructions defined to isolate analyzed repository content from the agent's control logic.
- Capability inventory: The agent can execute local shell commands via
bin/gcx, toolchain commands (go,gofmt), and version control operations (git) as described inSKILL.mdandreferences/distribution-and-gates.md. - Sanitization: No specific sanitization or filtering of repository data is mentioned, as the skill's primary purpose is to process source code directly.
Audit Metadata