skills/nrwl/nx/monitor-ci/Gen Agent Trust Hub

monitor-ci

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses dynamic context injection placeholders in SKILL.md to retrieve environmental information, including the current git branch, commit hash, and working tree status via git commands.\n- [COMMAND_EXECUTION]: The skill executes project-specific CLI tools including nx, pnpm, yarn, and git to monitor CI status, verify fixes locally, and commit changes. It also runs internal helper scripts (ci-poll-decide.mjs and ci-state-update.mjs) using the node runtime to manage the monitoring state machine.\n- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it processes external CI data from Nx Cloud, including task failure summaries and suggested code fixes. This data is used to inform the agent's decision-making process for local code modifications.\n * Ingestion points: External CI data fetched through the ci_information MCP tool (specifically using HEAVY_FIELDS).\n * Boundary markers: Not explicitly implemented in the skill instructions.\n * Capability inventory: The skill possesses capabilities to modify files (via nx-cloud apply-locally), execute shell commands, and spawn subagents for task verification.\n * Sanitization: The skill relies on deterministic script logic and subagent isolation to mitigate risks associated with untrusted data processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 02:55 AM
Security Audit — agent-trust-hub — monitor-ci