ort-ci
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFE
Full Analysis
- [Standard CI Operations]: The skill uses the official GitHub CLI (
gh) and API to interact with pull requests and workflow runs. These operations are limited to themicrosoft/onnxruntimerepository and are consistent with the skill's stated purpose of CI management. - [Trusted Infrastructure Interaction]: The skill references Azure Pipelines hosted on
aiinfra.visualstudio.comanddev.azure.com. These are well-known services managed by the vendor and are used here for legitimate status reporting and pipeline triggering. - [Local Script Utilization]: The skill references a local maintenance script (
rerun_failed_ci.sh) located within the project's own directory structure. This represents standard project-specific automation rather than an external or untrusted dependency. - [Triaging and Diagnostics]: The instructions emphasize diagnosing failures by downloading logs and classifying errors (e.g., C++ warnings, test failures) before attempting a re-run. This promotes safe and efficient use of CI resources.
- [Data Access Boundaries]: While the skill accesses PR metadata and CI logs, these actions are performed within the context of the user's authenticated session with the target repository and do not involve unauthorized data exfiltration or access to sensitive local environment secrets like SSH keys or AWS credentials.
Audit Metadata