grafeo-upstream-comms
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists entirely of instructional text, templates, and project-specific definitions designed to streamline communication between an agent and a developer.
- [SAFE]: All referenced entities, including the repositories (GrafeoDB/grafeo, agentmemorylabs/grafeo) and user handles (jarmen423, StevenBtw), are consistent with the stated development workflow and belong to the developer's known context.
- [SAFE]: The instructions include a clear safety constraint: 'Nothing goes to GitHub (pushes, PRs, issue comments) without his explicit OK,' which ensures human-in-the-loop control over network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for processing external data (GitHub issue review comments). While this presents a theoretical attack surface for indirect injection if a reviewer were to post malicious instructions, the risk is mitigated by the skill's structured template approach and the requirement for explicit user confirmation for all outgoing actions.
- [SAFE]: No obfuscated content, dynamic execution patterns, or unauthorized credential access attempts were found.
Audit Metadata