create-ol-rfc-discussion
Pass
Audited by Gen Agent Trust Hub on May 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill runs a local bash script and uses the
ghandjqcommand-line tools. These are used to format the RFC content and submit it to the GitHub GraphQL API. - [DATA_EXFILTRATION]: While the skill transmits content to an external service (GitHub), the destination is a specific repository belonging to the organization that authored the skill. No sensitive local data is accessed or exfiltrated.
- [SAFE]: The skill implements several security best practices. It uses a quoted heredoc (
'RFCEOF') when writing temporary files to prevent shell variable expansion of user-provided content. Additionally, the helper script usesjqto build JSON payloads, ensuring that special characters in the RFC text are correctly escaped and do not cause injection issues in the GraphQL mutation.
Audit Metadata