skills/metalbear-co/skills/mirrord-ci/Gen Agent Trust Hub

mirrord-ci

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided environment and target details to generate CI configuration files. It mitigates potential injection risks by instructing the agent to use the provided references/schema.json to validate all generated configurations using the mirrord verify-config command before presenting them to the user.
  • [COMMAND_EXECUTION]: The skill provides numerous examples of shell commands for CI workflows, including mirrord ci start/stop and kubectl. It maintains a strong security posture by explicitly warning users against using insecure installation patterns like piping remote scripts to a shell (curl | bash) and recommending the use of trusted CI images or pinned versions instead.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill handles sensitive CI components like KUBECONFIG and MIRRORD_CI_API_KEY by correctly instructing the user to store them as secrets within their CI platform's environment, rather than hardcoding them.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 11:51 AM