quantify-impact
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local scripts such as
scripts/resolve-pr-base.shand requires the agent to run user-defined benchmark or test commands (e.g.,bun test) to quantify impact. - [EXTERNAL_DOWNLOADS]: The instructions mandate installing dependencies from lockfiles for both the base and candidate code trees, which involves network access and potential execution of untrusted lifecycle hooks during the installation process.
- [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests code and configuration from PR branches and the local working tree (REFERENCE.md).
- Boundary markers: No explicit boundary markers or instructions are provided to prevent the agent from following malicious prompts that might be embedded in the code or PR descriptions being measured.
- Capability inventory: The skill has the capability to execute shell commands, run benchmarks, and interact with the filesystem (SKILL.md, REFERENCE.md).
- Sanitization: There is no evidence of sanitization for the commands or scripts loaded from the repository being evaluated.
Audit Metadata