verify-before-commit
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands for project verification, including type-checking (
npx tsc,go build), linting (eslint,go vet), and testing (npm test,go test). - [COMMAND_EXECUTION]: It executes local Python scripts within the repository (
harness/validators/task_lifecycle.pyandharness/scripts/code-logger.py) to validate and log task lifecycle transitions. - [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through the processing of repository files and wiki drafts.
- Ingestion points: Repository configuration files (
package.json,go.mod) and markdown draft documents inllmwiki/wiki/sources/draft/. - Boundary markers: Absent; the skill does not use delimiters to isolate content read from external files.
- Capability inventory: Subprocess execution via shell commands (
RUN) and file-write access to thellmwiki/wiki/directory. - Sanitization: Absent; there is no explicit validation or escaping of the content retrieved from the file system before it is processed or interpolated.
Audit Metadata