my-skills-vendor-sync
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses various command-line tools including
git,node,gh,mktemp,awk, andcmpto manage synchronization, file comparison, and issue tracking within the repository. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves data from GitHub issues via the
ghcommand. While it is designed to verify this data against local repository state before taking action, the ingestion of untrusted external content represents a potential attack surface. - Ingestion points: Issue bodies retrieved through
gh issue view. - Boundary markers: The instructions explicitly flag issue content as a plan to be verified, not as authoritative ground truth.
- Capability inventory: The skill can write to the filesystem, perform Git commits and pushes, and modify issue statuses.
- Sanitization: Actions are verified using a local script in dry-run mode to ensure consistency with the actual repository state.
Audit Metadata