mergify-ci
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
evalto process shell-formatted output from themergify ci git-refscommand. This is a standard mechanism to export variables such asMERGIFY_GIT_REFS_BASEinto the current shell session. - [DATA_EXFILTRATION]: The skill transmits test result metadata and JUnit XML content to
https://api.mergify.com. This is the primary function of the tool and targets the official Mergify API. - [CREDENTIALS_UNSAFE]: Sensitive authentication is handled via the
MERGIFY_TOKENenvironment variable. The skill documentation explicitly recommends using GitHub Secrets or equivalent secure storage, which aligns with industry best practices.
Audit Metadata