y-pr-title
Pass
Audited by Gen Agent Trust Hub on Apr 8, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/gather_context.py executes yadm commands using subprocess.run. The commands are constructed using lists rather than shell strings, which prevents shell injection. Specifically, it calls yadm branch, yadm log, and yadm diff to retrieve repository state.\n- [SAFE]: The skill's data access is confined to local repository metadata (git history and diffs) necessary for generating PR titles. No hardcoded credentials, network exfiltration, or persistence mechanisms were found.
Audit Metadata