orchestrate

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: The skill processes GitHub issue content (titles and descriptions) to automate branch creation and task planning. * Ingestion points: references/github-autopilot.md uses the gh CLI to fetch external data from GitHub issues. * Boundary markers: The skill looks for specific Markdown headers (e.g., ## Integration branch) to scope its parsing. * Capability inventory: The skill possesses the ability to manage Git branches, merge pull requests, and write files to the scratchpad and project directories. * Sanitization: Branch names derived from external titles are validated using git check-ref-format, and source URLs are verified against a strict regex before processing.
  • [COMMAND_EXECUTION]: The skill uses shell utilities and developer tools for its core logic. * Evidence: references/github-autopilot.md contains a script using git, gh, jq, awk, and sed to automate repository state management. * Context: The use of these tools is integral to the skill's purpose as a development orchestrator and relies on standard, well-known CLI applications.
  • [DATA_EXFILTRATION]: The skill implements best practices for secret management during automated runs. * Evidence: references/integration-traps.md includes a specific warning to avoid storing credentials in plans, commits, or browser captures, and advises inspecting captures for PII before persistence.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 09:39 PM
Security Audit — agent-trust-hub — orchestrate