lifecycle
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches lifecycle information from several external domains including access.redhat.com (Red Hat Product Life Cycles API), releases.aks.azure.com (Azure AKS data), and endoflife.date (public API for various software lifecycles). These are well-known, official, or reputable sources appropriate for the skill's stated purpose.
- [COMMAND_EXECUTION]: In
scripts/rhdh_lifecycle/yaml.py, the skill invokes thegh(GitHub) CLI viasubprocess.runto list repository contents when local data is unavailable. The command is constructed using a list of arguments (avoidingshell=True), which prevents typical command injection vulnerabilities. - [DATA_EXPOSURE]: The skill reads CI configuration files from the local
openshift/releaserepository (or fetches them from GitHub) to identify which Kubernetes versions are currently in use. This data access is restricted to the specific project context and does not target sensitive user credentials or system files. - [SAFE]: The skill uses the
ruamel.yamllibrary for parsing configuration files, which is a standard and safe practice in Python for handling YAML data.
Audit Metadata