deployment-checklist-generator
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes boilerplate code for bash scripts (such as smoke-tests.sh) and GitHub Action workflows that execute shell commands to perform health checks, status updates, and deployment logic. These commands are typical for the skill's stated purpose.
- [EXTERNAL_DOWNLOADS]: The GitHub Action workflow templates reference external third-party actions, specifically trstringer/manual-approval@v1, to implement manual approval gates within the deployment process.
- [INDIRECT_PROMPT_INJECTION]: The Sign-off Template creates a surface for indirect prompt injection by instructing the agent to fetch and include content from external files like CHANGELOG.md when generating GitHub issues. Ingestion point: CHANGELOG.md file. Boundary markers: None present in the template. Capability inventory: The workflow template utilizes GITHUB_TOKEN to perform repository actions such as creating deployments and issues. Sanitization: The instructions do not specify any validation or sanitization for the ingested changelog content.
Audit Metadata