dependabot-stack

Pass

Audited by Gen Agent Trust Hub on Aug 24, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the gh (GitHub CLI) and git command-line tools to list PRs, fetch branches, manage worktrees, and rebase code.
  • It utilizes gh extension install github/gh-stack to install a known utility from a trusted source (GitHub's own organization).
  • It performs destructive operations like git push --force-with-lease and git rebase, but these are explicitly limited to Dependabot-authored branches (app/dependabot) and are performed within a temporary scratch worktree created via mktemp -d to avoid modifying the user's current working directory.
  • Argument interpolation is used to define the target repository, but execution remains scoped to standard developer workflows and Git operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 24, 2026, 01:49 PM
Security Audit — agent-trust-hub — dependabot-stack