devops-pipeline

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various shell commands to perform repository synchronization, detect project stacks, and install/run the pre-commit framework.
  • [EXTERNAL_DOWNLOADS]: The configuration templates reference external pre-commit hooks hosted on GitHub (e.g., from astral-sh, PyCQA, and pre-commit organizations). These are well-known and standard resources within the DevOps ecosystem.
  • [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading local project documentation (README.md) and source code to identify CLI commands for end-to-end test generation. Malicious content in these project files could theoretically influence the agent's script generation.
  • Ingestion points: Project README.md and source files (e.g., those using click, argparse, or cobra).
  • Boundary markers: None used when interpolating discovered commands into test scripts.
  • Capability inventory: Shell command execution via bash, git, pip, and pre-commit.
  • Sanitization: No specific sanitization or validation of the extracted command strings before they are written to scripts/e2e_test.sh.
  • [DYNAMIC_EXECUTION]: The skill generates a shell script (scripts/e2e_test.sh) to perform smoke tests on CLI tools and then executes that script to verify the project's quality gates.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 03:33 PM