mergify-config
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a wrapper for the
mergify-clitool, providing instructions for validating and simulating pull request automation rules. All external resources, including documentation URLs and the JSON schema, are hosted on the officialmergify.comdomain. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, which is an inherent part of its functionality.
- Ingestion points: Reads local configuration files (e.g.,
.mergify.yml) and fetches documentation fromhttps://docs.mergify.com. - Boundary markers: None explicitly defined in the prompt instructions for separating untrusted file content from system instructions.
- Capability inventory: The skill uses the
mergifycommand-line interface to execute validation and simulation logic, which includes network access to the Mergify API. - Sanitization: The skill relies on the
mergify-clitool's internal validation against a formal JSON schema to ensure configuration integrity.
Audit Metadata