fondo-ci-integration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No security issues detected. The skill provides guidance and templates for financial CI/CD automation that emphasize the use of mock data, environment-scoped secrets, and output redaction.
- [SAFE]: Network communications are directed to the official Fondo API (api.fondo.com), which is the legitimate service endpoint for the integration.
- [SAFE]: Sensitive credentials like API keys are managed through standard environment variables and GitHub Action secrets rather than being hardcoded.
- [INDIRECT_PROMPT_INJECTION]: The skill defines workflows that ingest data from the Fondo API, presenting a potential surface for indirect prompt injection; however, the instructions specifically mandate the use of fictional fixtures and redaction of output to mitigate these risks.
Audit Metadata