mergify-config

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill serves as a wrapper for the mergify-cli tool, providing instructions for validating and simulating pull request automation rules. All external resources, including documentation URLs and the JSON schema, are hosted on the official mergify.com domain.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data, which is an inherent part of its functionality.
  • Ingestion points: Reads local configuration files (e.g., .mergify.yml) and fetches documentation from https://docs.mergify.com.
  • Boundary markers: None explicitly defined in the prompt instructions for separating untrusted file content from system instructions.
  • Capability inventory: The skill uses the mergify command-line interface to execute validation and simulation logic, which includes network access to the Mergify API.
  • Sanitization: The skill relies on the mergify-cli tool's internal validation against a formal JSON schema to ensure configuration integrity.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 10:52 AM
Security Audit — agent-trust-hub — mergify-config