quarterly-work-dashboard

Pass

Audited by Gen Agent Trust Hub on Jul 24, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses subprocess.run across multiple scripts (run_quarterly_work_dashboard.py, generate_github_quarterly_dashboard.py, etc.) to execute local CLI tools like gh and lark-cli. These calls are implemented securely using lists for arguments, which prevents shell injection vulnerabilities.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub and Feishu APIs through official CLI tools. These interactions are read-only and targeted at well-known technology services.
  • [SAFE]: The skill processes external data such as PR titles, document content, and chat messages to generate reports. It implements HTML escaping (html.escape) when rendering this data into the dashboard, effectively mitigating common presentation-layer risks like Cross-Site Scripting (XSS).
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 24, 2026, 08:57 AM
Security Audit — agent-trust-hub — quarterly-work-dashboard