issue-viz
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses git, gh, and curl via the node:child_process.spawnSync API to interact with repositories and issue trackers. All commands are executed with arguments passed as arrays, which prevents command injection vulnerabilities.- [EXTERNAL_DOWNLOADS]: The issue-media.mjs module handles image downloads from GitHub and other sources using curl. It implements a security check by verifying file signatures (magic numbers) to ensure the content matches expected image formats before use.- [DATA_EXFILTRATION]: Communication with external services (GitHub, Jira, and Confluence) is limited to the primary purpose of managing issues and publishing documentation. Network operations target established providers based on user-defined configuration.- [SAFE]: The issue-viz.mjs script includes specific protections against Cross-Site Scripting (XSS) by escaping HTML-sensitive characters (such as <, >, and &) when embedding project data into the generated HTML visualization.
Audit Metadata