oh-ci
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill employs standard repository management practices, such as using
git worktreefor isolation and the official GitHub CLI (gh) for interacting with pull request metadata and CI logs. - [COMMAND_EXECUTION]: The skill executes shell commands to perform its primary function.
- Evidence: Commands like
git fetch,gh pr view, andgh run view --log-failedare used appropriately within the context of a CI-fixing tool. - Context: Build commands like
pnpm testorcargo testare suggested for verification, which is expected for a developer-oriented skill. - [PROMPT_INJECTION]: The skill processes untrusted data originating from external CI logs and PR source code.
- Ingestion points: CI logs fetched via
gh run view --log-failedand source file content are ingested into the agent context in step 4. - Boundary markers: The skill does not explicitly define markers to delimit external content, relying on the agent's logic to parse logs.
- Capability inventory: The skill possesses the ability to write to the filesystem, execute shell commands, and push code to remote repositories.
- Sanitization: No explicit sanitization or filtering of log content is performed before analysis.
Audit Metadata