rhdh-prow-trigger
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
occommand-line tool to retrieve authentication tokens and verify the cluster context. These executions are performed securely using the Pythonsubprocessmodule withshell=False, ensuring that arguments are not interpreted by a shell. - [EXTERNAL_DOWNLOADS]: The skill fetches lists of CI jobs and container image tags from
prow.ci.openshift.organdquay.io. These operations target official project resources and use strict regular expressions to parse the retrieved data. - [DATA_EXPOSURE]: The skill accesses a dedicated configuration file at
~/.config/openshift-ci/kubeconfigfor API authentication. It is designed to handle credentials internally, ensuring that session tokens are never included in command arguments, script outputs, or messages returned to the AI agent.
Audit Metadata