ci-cd-integration
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes official and well-known external resources to facilitate CI/CD workflows. It references GitHub Actions from the official
actions/organization and popular community-maintained tools such asdorny/test-reporterandmarocchino/sticky-pull-request-comment. Additionally, it uses official Docker images from Microsoft (mcr.microsoft.com/playwright) for running Playwright tests and suggests well-known industry services like Datadog, CloudBees, and Trunk for advanced test optimization and flaky test management. - [COMMAND_EXECUTION]: The skill provides structured templates for executing standard development commands within GitHub Actions and GitLab CI environments. This includes using
npmandnpxfor dependency management and running test suites (Jest, Playwright, Vitest), as well as utilizing cloud-specific CLI tools likeawsfor OIDC-based deployment. The instructions include safe patterns for starting background processes and waiting for service readiness. - [INDIRECT_PROMPT_INJECTION]: The skill identifies a standard surface for indirect prompt injection by reading project-specific context from local files to calibrate its output.
- Ingestion points: The skill is designed to read metadata and CI requirements from the project's
.agents/qa-project-context.mdfile (specified inSKILL.md). - Boundary markers: The instructions do not define specific delimiters or warnings for the content read from this context file.
- Capability inventory: The skill has the capability to generate and execute shell commands and cloud deployment scripts based on the ingested configuration.
- Sanitization: No specific sanitization or validation methods are mentioned for the inputs retrieved from the project context file, as it is treated as a trusted local configuration source.
Audit Metadata