afk-pipeline
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and installs standard development tools such as Bun, GitHub CLI, Claude Code, Cursor, and Grok from their official, well-known domains during the sandbox build process.
- [REMOTE_CODE_EXECUTION]: Executes official installation scripts for well-known developer tools using piped shell commands. These downloads originate from trusted providers and are documented neutrally.
- [COMMAND_EXECUTION]: Runs a multi-phase implementation and verification loop that includes a security integrity check. The 'assertControlPlane' function compares the active orchestration code against a trusted git snapshot to ensure the pipeline has not been tampered with by implementing agents.
- [CREDENTIALS_UNSAFE]: Manages necessary repository secrets and provider authentication tokens to enable automated code implementation and PR creation. These are handled using standard CI/CD practices and passed to isolated sandbox environments.
- [PROMPT_INJECTION]: Ingests untrusted data from GitHub issues but mitigates potential injection attacks through a dedicated neutralization module. The 'neutralizeHostileText' function sanitizes content by stripping HTML, neutralizing URLs, and preventing unwanted mentions before generating PR comments.
Audit Metadata