oh-ci

Pass

Audited by Gen Agent Trust Hub on Aug 6, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill employs standard repository management practices, such as using git worktree for isolation and the official GitHub CLI (gh) for interacting with pull request metadata and CI logs.
  • [COMMAND_EXECUTION]: The skill executes shell commands to perform its primary function.
  • Evidence: Commands like git fetch, gh pr view, and gh run view --log-failed are used appropriately within the context of a CI-fixing tool.
  • Context: Build commands like pnpm test or cargo test are suggested for verification, which is expected for a developer-oriented skill.
  • [PROMPT_INJECTION]: The skill processes untrusted data originating from external CI logs and PR source code.
  • Ingestion points: CI logs fetched via gh run view --log-failed and source file content are ingested into the agent context in step 4.
  • Boundary markers: The skill does not explicitly define markers to delimit external content, relying on the agent's logic to parse logs.
  • Capability inventory: The skill possesses the ability to write to the filesystem, execute shell commands, and push code to remote repositories.
  • Sanitization: No explicit sanitization or filtering of log content is performed before analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 6, 2026, 04:54 PM
Security Audit — agent-trust-hub — oh-ci