workflow
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions provide a structured approach for an AI agent to act as a coordinator. It includes specific safety guidelines, such as 'Never merge, close PRs, comment, label, deploy, force-push, or touch production/secrets unless the start contract grants that exact action.'
- [COMMAND_EXECUTION]: The skill suggests using
npx skillsfor discovery.npxis a standard Node.js utility used here for exploring available capabilities within the environment, which is expected behavior for an orchestration tool. - [SAFE]: While the skill interacts with external data (PR metadata, bot reviews, and user messages), it acts as a coordinator with a 'human-in-the-loop' requirement for approval gates and final decisions, mitigating risks associated with indirect prompt injection.
Audit Metadata