verification
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [SAFE]: The skill consists of legitimate instructions for verifying software changes. No malicious patterns such as obfuscation, credential theft, or unauthorized network access were found.
- [COMMAND_EXECUTION]: The instructions involve running local build and testing tools (e.g.,
mvn,yarn,pytest,make) to confirm code quality. These commands are typical for the OpenMetadata project and do not involve suspicious remote execution or privilege escalation. - [INDIRECT_PROMPT_INJECTION]: The skill defines a process for ingesting external data via command output to be used as evidence. * Ingestion points: Command-line output from test runners and build tools (SKILL.md). * Boundary markers: The instructions specify a structured 'Evidence Format' using markdown sections, which helps distinguish command output from agent instructions. * Capability inventory: The skill uses subprocess execution for
mvn,yarn,python, andmake(SKILL.md). * Sanitization: There is no mention of explicit sanitization or filtering of the captured output before it is included in the agent's response.
Audit Metadata