add-linter

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill guides the agent to use Bash for building the project (make megalinter-build) and testing linter integration via Docker containers (docker buildx build, docker run). These are standard operations within the MegaLinter development environment intended for developers and contributors.
  • [EXTERNAL_DOWNLOADS]: The skill uses WebSearch and WebFetch to gather information (URLs, rules, configuration) from external linter documentation. This data is used to populate metadata in the project's descriptors.
  • [PROMPT_INJECTION]: As the skill ingests content from external websites during the research phase, there is a surface for indirect prompt injection. The skill implements a structured workflow where the agent maps specific gathered information into a YAML schema, which acts as a natural boundary.
  • Ingestion points: Step 1 uses WebSearch and WebFetch to read third-party documentation.
  • Boundary markers: The information is interpolated into a highly structured YAML schema in Step 2, which helps isolate external text from control instructions.
  • Capability inventory: The agent has access to Write, Bash, and Edit to modify the local repository and execute build scripts.
  • Sanitization: The skill relies on the agent's ability to extract specific technical fields (regex, URLs, license IDs) from the fetched data.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 06:55 PM
Security Audit — agent-trust-hub — add-linter