quality-gates-enforcer
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The CI configuration examples reference third-party GitHub Actions, such as
romeovs/lcov-reporter-actionandandresz1/size-limit-action, to automate quality reporting and bundle size monitoring. These are common community-maintained utilities for CI workflows. - [INDIRECT_PROMPT_INJECTION]: The skill documents a quality reporting mechanism that captures output from development tools (like npm, tsc, and ls) and interpolates it into a markdown report for PR comments. This design represents a vulnerability surface where manipulated tool output could potentially lead to markdown injection in the pull request discussion.
- Ingestion points: Shell command outputs captured in the 'Quality Report' generation step.
- Boundary markers: None defined to isolate tool output from the report structure.
- Capability inventory: The workflow uses
actions/github-scriptto post comments to the GitHub API. - Sanitization: The provided snippets do not include logic to sanitize or escape the tool outputs before they are added to the markdown report.
Audit Metadata