ship
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes build and test commands defined in the project configuration files (
CLAUDE.mdorAGENTS.md) to verify changes before shipping.\n- [COMMAND_EXECUTION]: Uses thegreputility throughlib/quote-gate.mdto validate that quotes and citations in learning artifacts match the source code.\n- [EXTERNAL_DOWNLOADS]: Synchronizes the local environment with remote changes usinggit pullduring the pre-flight phase.\n- [DATA_EXFILTRATION]: Transfers code and metadata to remote repositories usinggit pushand the GitHub CLI (gh pr create), which are standard operations for code delivery to the project's configured remote hosts.\n- [PROMPT_INJECTION]: The skill processes untrusted project data (briefs, configuration files) which could theoretically influence agent behavior, though this is managed as part of the intended project context.\n - Ingestion points: Reads test commands and scope definitions from
CLAUDE.md,AGENTS.md, anddocs/briefs/**.\n - Boundary markers: None explicitly defined for the project-level command execution.\n
- Capability inventory: Includes full repository read/write access, shell execution, and network access via Git/GitHub.\n
- Sanitization: No specific sanitization is performed on project-defined build/test strings.
Audit Metadata