CI/CD Validation & Merge Workflow
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate instructions for project maintenance, including code formatting, linting, and testing. All documented commands are standard for Rust development environments.
- [COMMAND_EXECUTION]: The workflow relies on shell command execution for its primary functions, including repository management (
git), build automation (cargo), and GitHub interaction (gh). It also involves executing a local validation script (./scripts/ci/validate-cleanup.sh) to automate pre-push checks. - [PROMPT_INJECTION]: The skill defines workflows that involve reading external content, such as pull request descriptions and CI logs, which introduces a surface for indirect prompt injection.
- Ingestion points:
gh pr viewandgh run view --logare used inSKILL.mdandmerge-process.mdto retrieve external data from GitHub. - Boundary markers: Absent; the instructions do not specify the use of delimiters or warnings to isolate external data from core instructions.
- Capability inventory: The agent has the ability to compile code, execute tests, and modify repository state through merging pull requests.
- Sanitization: No explicit sanitization or validation of the content retrieved from GitHub is mentioned in the instructions.
Audit Metadata