simplify-and-harden-ci
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Installs the
github/gh-awextension, which is an official or well-known tool for managing agent workflows on GitHub. - [EXTERNAL_DOWNLOADS]: Fetches skill configuration from the
pskoett/pskoett-skillsrepository, which is identified as a legitimate vendor resource for this skill. - [COMMAND_EXECUTION]: Executes shell commands including
gh,npx, andgh-awto install extensions, add skills, and compile workflow templates. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data (code changed in Pull Requests) for analysis, creating a potential surface for indirect prompt injection, though it lacks direct auto-remediation capabilities which mitigates the risk.
Audit Metadata