ci-auto-fix
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes untrusted data from external CI logs and GitHub PR metadata, creating a surface for indirect prompt injection.
- Ingestion points: CI logs are fetched and parsed in Phase 1; repository source code and configuration are inspected in Phase 2.
- Boundary markers: The skill does not define explicit delimiters for separating log content from instructions, though it mandates extracting specific context rather than dumping raw logs.
- Capability inventory: The skill has significant capabilities, including file modification, execution of
gitcommands (commit, push, revert), and interaction with the GitHub CLI (gh). - Sanitization: The skill incorporates a strict 'anti-patterns' policy (rules/anti-patterns.md) that prohibits weakening tests, skipping checks, or performing unauthorized actions.
- [DYNAMIC_EXECUTION]: The skill employs a 'self-improvement loop' that retrieves previously learned 'lessons' to influence current diagnostic verdicts.
- Evidence: The
self-improvement-loop.mdrule describes usingmemory.searchto fetch advisory lessons during Phase 3 to bias classification. - Guardrails: This dynamic behavior is constrained by 'entrenchment guards' ensuring that retrieved lessons cannot authorize broad-scope actions or bypass the evidence-gated verification process.
Audit Metadata