openevidence-ci-integration
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill contains legitimate configuration files, test suites, and documentation for setting up CI/CD workflows. No malicious patterns, such as prompt injection, obfuscation, or unauthorized data exfiltration, were detected.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill demonstrates safe handling of sensitive credentials by instructing users to utilize GitHub Actions Secrets (
${{ secrets.OPENEVIDENCE_API_KEY }}) and environment variables, which prevents API keys from being hardcoded in the repository. - [EXTERNAL_DOWNLOADS]: The skill references official service domains (
openevidence.com) and the author's verified professional domains (intentsolutions.io,jeremylongshore.com). These references are appropriate for the skill's functionality. - [INDIRECT_PROMPT_INJECTION]: The skill involves processing data from the OpenEvidence API within a testing context.
- Ingestion points: External API responses are ingested in
tests/integration/openevidence.integration.test.ts. - Boundary markers: The skill relies on Vitest's assertion framework to validate structured data.
- Capability inventory: The ingested data is confined to the test environment and does not interact with system commands or sensitive file operations.
- Sanitization: The skill validates the structure of the API response using property checks (e.g.,
expect(body).toHaveProperty('answer')) and regex validation for identifiers.
Audit Metadata