python-quality-gate
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to "read and follow the repository's CLAUDE.md before any execution." Because this file is part of the project being analyzed and not the skill itself, it could contain untrusted instructions that might influence the agent's behavior during the quality gate process.
- Ingestion points: The skill reads
CLAUDE.md,pyproject.toml,setup.py,setup.cfg,mypy.ini, and.python-versionfrom the project environment. - Boundary markers: There are no explicit delimiters or specific instructions to treat the content of
CLAUDE.mdas untrusted data rather than authoritative instructions. - Capability inventory: The skill uses the
Bashtool to execute various quality tools (ruff,pytest,mypy,bandit) andgit, and utilizesWriteto generate report files. - Sanitization: The skill captures and displays raw command output from the quality tools. If the source code being scanned contains malicious strings designed to trigger specific tool output, those strings are presented to the agent context without sanitization.
Audit Metadata