running-bug-review-board
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXFILTRATION]: The skill integrates with well-known issue trackers such as Linear, GitHub, Jira, and Notion. It follows secure practices by explicitly instructing the user to store API tokens and passwords in secure vaults or environment variables rather than hardcoding them or committing them to the repository. The data synchronization logic (pushing bug reports) is part of the stated primary purpose of the skill and targets well-known service endpoints.
- [EXTERNAL_DOWNLOADS]: The documentation references a curated list of 'companion skills' and CLI tools for iOS simulator automation (e.g., AXe, XcodeBuildMCP, baguette). These are presented as recommendations for the user to install manually. All referenced sources are specific, credited repositories on well-known platforms like GitHub, falling within the scope of trusted external services.
- [COMMAND_EXECUTION]: The skill utilizes small, local bash scripts (
scaffold-qa.sh,bugs-needing-sync.sh,bugs-needing-pull.sh) to manage the QA folder structure and identify data synchronization needs. These scripts use standard shell utilities (awk, sed, jq) and implement proper variable quoting to prevent typical shell injection vulnerabilities. Execution of these scripts is a functional requirement for the skill's operations. - [PROMPT_INJECTION]: The skill uses a multi-agent 'coordinator/shard' pattern where it generates specific prompts to be used in separate agent sessions. While these templates define roles ('You are the facilitator'), they do not attempt to bypass core safety guardrails or ignore system instructions. They are used legitimately to maintain session hygiene and prevent context contamination.
- [SAFE]: The skill generates HTML reports using skeletal templates. It includes a specific 'Information hierarchy contract' and 'Rendering rules' that mandate the escaping of all user-supplied text (such as console logs or bug titles) using HTML entities. This prevents potential cross-site scripting (XSS) or rendering issues when viewing reports in a browser.
- [SAFE]: The skill demonstrates high awareness of security and reliability through its 'Session hygiene' playbook, which emphasizes clearing local storage and using unique personas to prevent state leakage and rate-limiting issues during testing.
Audit Metadata