pre-merge-gate
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates various development tools including
npm,pytest,ruff, andvue-tscto verify project health. It usessubprocess.runwithshell=Falseand resolves executable paths usingshutil.whichto mitigate command injection risks. - [DYNAMIC_EXECUTION]: The
pre_merge_gate.pyscript dynamically locates and executes other internal skill scripts (e.g.,verify_setup.py,find_duplicate_ui.py) located within the.agents/skills/or.cursor/skills/directories of the project root. It also utilizes__import__('re')within a helper function to extract routes from documentation, which is a benign use of dynamic module loading for standard library utilities.
Audit Metadata