Skills
Navigate
skills/redhat-developer/rhdh-skills/compute-plugin-package-overlay-cve-list/Gen Agent Trust Hub

compute-plugin-package-overlay-cve-list

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes git and GitHub CLI (gh) commands to extract commit history and pull request details. All commands are executed using spawnSync with argument arrays, which prevents shell injection, and are restricted to the vendor's own repositories.
  • [EXTERNAL_DOWNLOADS]: The skill clones the rhdh-plugin-export-overlays repository from GitHub. As this is an official repository from the author (redhat-developer), it is a legitimate resource and considered safe under vendor context.
  • [PROMPT_INJECTION]: The skill processes external text from Git logs and PR bodies, representing a surface for indirect prompt injection. The script effectively mitigates this by using strict regular expression patterns to extract only valid CVE and JIRA identifiers, preventing the agent from following embedded instructions in commit messages or PR descriptions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 08:20 PM
Security Audit — agent-trust-hub — compute-plugin-package-overlay-cve-list