branch-cleanup

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard git and gh (GitHub CLI) commands to inspect branch metadata, check pull request statuses, and verify repository settings. These are necessary for the skill's primary function and are implemented using subprocess.run with proper argument handling and shell quoting via shlex.quote in the Python script.
  • [REMOTE_CODE_EXECUTION]: The skill uses github.token within a GitHub Action workflow file (assets/stale-branch-report.yml). This is a standard practice for automated reports within the GitHub ecosystem. The workflow is restricted to reading content and pull requests, and it only writes to the job summary, ensuring no destructive remote operations can occur through this mechanism.
  • [SAFE]: The skill follows security best practices by implementing an 'explicit authorization' guardrail. It prints the exact commands for the user to review and manually execute rather than performing deletions itself. It also uses SHA-pinned versions for external actions (e.g., actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd) to mitigate supply chain risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 07:19 PM