dev-cycle
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill orchestrates development workflows by executing local shell commands for
gitand forge-specific CLI tools such asgh(GitHub),glab(GitLab),fj(Forgejo), andtea(Gitea). - [DYNAMIC_EXECUTION]: It implements logic to discover and execute project-specific scripts located in
scripts/orbin/directories that match common patterns likelint,test, orverify, which is a standard feature for development automation tools. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository, including
CHANGELOG.mdfiles and pull request bodies, as part of the development and release workflow. This represents a known surface area for indirect prompt injection inherent to developer-focused agents. - [DATA_EXFILTRATION]: Performs network operations to push code and metadata to remote forges (GitHub, GitLab, Bitbucket, etc.), which is the primary intended purpose of the tool for synchronization and collaboration.
Audit Metadata