run-pre-merge-checks
Warn
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill explicitly requests to disable the security sandbox (dangerouslyDisableSandbox: true) to enable access to local file system paths including the user's home directory cache (~/.cache/uv) and system-wide temporary directories (/tmp/pre-merge-checks/).
- [COMMAND_EXECUTION]: Use of user-defined parameters such as 'test_path' and 'extra_args' directly within shell execution strings (e.g., 'uv run pytest {test_path} ... {extra_args}') introduces a potential command injection vulnerability if inputs are maliciously crafted.
- [CREDENTIALS_UNSAFE]: The execution flow requires access to and validation of sensitive authentication data, specifically reading from 'secrets/secrets.json' and checking the 'NVIDIA_API_KEY' environment variable.
- [EXTERNAL_DOWNLOADS]: The skill facilitates network communication with external NVIDIA Inference Hub backends to perform live production tests, which is consistent with its stated purpose but involves external data exchange.
Audit Metadata