quarterly-work-dashboard
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runacross multiple scripts (run_quarterly_work_dashboard.py,generate_github_quarterly_dashboard.py, etc.) to execute local CLI tools likeghandlark-cli. These calls are implemented securely using lists for arguments, which prevents shell injection vulnerabilities. - [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub and Feishu APIs through official CLI tools. These interactions are read-only and targeted at well-known technology services.
- [SAFE]: The skill processes external data such as PR titles, document content, and chat messages to generate reports. It implements HTML escaping (
html.escape) when rendering this data into the dashboard, effectively mitigating common presentation-layer risks like Cross-Site Scripting (XSS).
Audit Metadata