pre-merge-gate

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill orchestrates various development tools including npm, pytest, ruff, and vue-tsc to verify project health. It uses subprocess.run with shell=False and resolves executable paths using shutil.which to mitigate command injection risks.
  • [DYNAMIC_EXECUTION]: The pre_merge_gate.py script dynamically locates and executes other internal skill scripts (e.g., verify_setup.py, find_duplicate_ui.py) located within the .agents/skills/ or .cursor/skills/ directories of the project root. It also utilizes __import__('re') within a helper function to extract routes from documentation, which is a benign use of dynamic module loading for standard library utilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 09:34 PM