rhdh-overlay
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes Python scripts (
scripts/analyze-pr.pyandscripts/triage-prs.py) that interface with the GitHub CLI (gh) to perform read-only operations such as listing pull requests and fetching metadata. These scripts utilizesubprocess.runwith argument lists rather than shell strings, effectively mitigating risk of shell injection. - [EXTERNAL_DOWNLOADS]: Workflow instructions in
workflows/onboard-plugin.mdandworkflows/fix-build.mdincludecurlcommands to fetch plugin metadata (backstage.json) from GitHub's raw content service (raw.githubusercontent.com). These operations target well-known repositories to verify version compatibility and do not involve the execution of untrusted remote scripts. - [SAFE]: The skill implements a robust safety model for repository modifications. All external write operations, such as commenting on PRs or pushing code, are channeled through a "Guarded publish" procedure and a
mutation-gatemechanism, ensuring that the AI agent cannot perform state-changing actions without explicit user review and approval.
Audit Metadata