moai-workflow-ci-loop
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface because it processes untrusted data from external sources to diagnose and fix CI failures.
- Ingestion points: Untrusted content from GitHub Actions logs and Git repository diffs is fetched via
scripts/ci-autofix/log-fetch.shand passed to a subagent (manager-develop). - Boundary markers: The skill uses a structured JSON handoff to manage the data flow, but does not explicitly define LLM-level delimiters or instructions to ignore embedded commands within the log content.
- Capability inventory: The skill has access to the
Bashtool and can execute shell scripts, perform git operations, and push code changes. - Sanitization: No explicit sanitization or filtering of the fetched external log data is mentioned before processing.
- [COMMAND_EXECUTION]: The skill relies on the execution of local shell scripts (
scripts/ci-watch/run.sh,scripts/ci-autofix/classify.sh, etc.) and system utilities such asyqand the GitHub CLI (gh). It includes an internal policy to prevent the use of dangerous flags like--forceor--force-with-leaseduring git operations.
Audit Metadata