verasic-github-governance
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell scripts to automate repository configuration tasks, such as copying templates, wiring git hooks, and querying the GitHub API via the 'gh' CLI. These operations are aligned with the skill's stated purpose of managing repository governance.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes repository configuration data, including workflow files and 'turbo.json', and ingests GitHub API responses. While this presents a standard attack surface, the skill implements boundary markers like '# verasic-governance-ci: managed' to distinguish managed content. Capabilities are limited to local file system operations and authenticated GitHub API calls.\n- [DYNAMIC_EXECUTION]: The 'scripts/test-regression.sh' script contains an 'assert' helper that uses 'eval' to run localized test commands. This usage is confined to the regression testing suite and does not involve untrusted remote input.\n- [PRIVILEGE_ESCALATION]: Scripts use 'chmod +x' to set executable permissions on git hooks being installed into the repository. This is a routine operation for configuring repository hooks and does not involve gaining unauthorized system-level privileges.
Audit Metadata