devops-pipeline
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands to perform repository synchronization, detect project stacks, and install/run the
pre-commitframework. - [EXTERNAL_DOWNLOADS]: The configuration templates reference external pre-commit hooks hosted on GitHub (e.g., from
astral-sh,PyCQA, andpre-commitorganizations). These are well-known and standard resources within the DevOps ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading local project documentation (README.md) and source code to identify CLI commands for end-to-end test generation. Malicious content in these project files could theoretically influence the agent's script generation.
- Ingestion points: Project
README.mdand source files (e.g., those usingclick,argparse, orcobra). - Boundary markers: None used when interpolating discovered commands into test scripts.
- Capability inventory: Shell command execution via
bash,git,pip, andpre-commit. - Sanitization: No specific sanitization or validation of the extracted command strings before they are written to
scripts/e2e_test.sh. - [DYNAMIC_EXECUTION]: The skill generates a shell script (
scripts/e2e_test.sh) to perform smoke tests on CLI tools and then executes that script to verify the project's quality gates.
Audit Metadata