rea-ci-tests-audit
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions and referenced documentation (specifically
SKILL.mdandtesting.md) guide the agent to execute various shell commands to perform audits. These include repository management (git fetch,git worktree), dependency installation (npm ci), and test suite execution (npm run test:fast,npm run build:cached). These commands are standard for the intended developer-centric audit use case. - [INDIRECT_PROMPT_INJECTION]: The skill inherently processes external, potentially untrusted data from the
morluto/rearepository during audits. - Ingestion points: The agent reads source code, test fixtures (including intentionally malformed ones), and CI output logs (referenced in
SKILL.md). - Boundary markers: The skill explicitly instructs the agent to use isolated worktrees ("worktree isolé") and dedicated temporary directories ("répertoire /tmp dédié") to isolate the audit task from other environments.
- Capability inventory: The agent can execute arbitrary shell commands via npm scripts and perform network operations via Git, though the instructions restrict these to local investigation and forbid unauthorized pushes or merges.
- Sanitization: The documentation (in
CONTRIBUTING.md) specifies that sensitive data such as bridge tokens and environment variables are automatically redacted from diagnostic logs. - [EXTERNAL_DOWNLOADS]: The skill requires network access to sync the target repository (
git fetch) and install development dependencies (npm ci). These operations target the official project repository and standard package registries, which is expected behavior for an audit and development tool.
Audit Metadata