skills/nubjs/nub/ci-triage/Gen Agent Trust Hub

ci-triage

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands including gh, git, jq, sed, and grep to interact with GitHub repositories and process workflow data. These operations target the vendor's own repository (nubjs/nub) and are appropriate for CI diagnostic tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external CI logs, creating a potential surface for indirect prompt injection.
  • Ingestion points: GitHub Actions failure logs retrieved via gh run view --log-failed and check-run metadata from the GitHub API.
  • Boundary markers: Absent. There are no instructions or delimiters to help the agent distinguish between log content and operational commands.
  • Capability inventory: The skill has shell execution capabilities via gh, git, sed, jq, and grep.
  • Sanitization: The skill strips ANSI escape sequences from logs using sed for readability, but does not sanitize or filter the content for malicious prompt instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 01:02 AM
Security Audit — agent-trust-hub — ci-triage