claim-safety
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a robust procedure for managing task concurrency in a multi-agent environment. It explicitly warns against assuming success from idempotent commands and mandates a secondary proof-of-ownership step.
- [COMMAND_EXECUTION]: The skill uses the
forgeCLI through a restricted Bash tool (forge:*). The commands described (forge claim,forge issue owns,forge close,forge release) are consistent with the skill's stated purpose of issue management and do not exhibit patterns of arbitrary command execution or system-level tampering. - [INDIRECT_PROMPT_INJECTION]: The skill involves reading external data from the
forgetool (e.g.,forge issue ready). While this is a potential ingestion point for untrusted data, the skill's logic is focused on structural lease management (JSON fields likeowned,expired,actor) rather than executing natural language instructions from the issue body, which significantly mitigates injection risks.
Audit Metadata