scaffold-github-cloud-agent-environment
Pass
Audited by Gen Agent Trust Hub on Nov 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The Python utility scripts (suggest_plan.py, doctor.py) invoke a local bash script (audit_project.sh) using subprocess.run to perform repository inspection. This is a standard part of the tool's diagnostic and scaffolding pipeline and operates within the target project scope.- [INDIRECT_PROMPT_INJECTION]: The skill performs static analysis on local repository files (e.g., package.json, Makefile, .gitattributes) to determine necessary build steps. While these files are untrusted external inputs, the skill implements robust YAML sanitization and quoting in copilot_env_lib.py to prevent the content of these files from influencing the generated workflow structure in a malicious way.
- Ingestion points: audit_project.sh reads package.json and workflow files.
- Boundary markers: Data is structured as JSON between the audit and suggestion phases.
- Capability inventory: render_setup_workflow.py writes a specific YAML file to the .github/workflows directory.
- Sanitization: The quote_yaml function in copilot_env_lib.py ensures all interpolated values are correctly escaped for YAML.- [SAFE]: The skill includes explicit security boundaries, such as rejecting symlinks in render_setup_workflow.py to prevent arbitrary file writes outside the target project directory. It also follows security best practices by explicitly instructing the agent and user not to inline secrets into the generated workflow, directing them to use GitHub's official environment secret mechanism instead.
Audit Metadata