oss-contributor-onboarding
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes and executes a local bash script (
scripts/contributor-path-audit.sh) that uses standard tools (git, grep, awk) to collect metrics on repository files and contributor history for the purpose of a health audit.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes potentially untrusted content from the target repository, including CONTRIBUTING files, pull request comments, and issue descriptions, to identify onboarding barriers.\n - Ingestion points: External data enters the context via the audit script reading repository files and the agent reading forge API outputs (PRs/issues).\n
- Boundary markers: No specific delimiters or instructions to ignore instructions in processed data are explicitly defined in the provided files.\n
- Capability inventory: The skill uses the shell to execute a local metrics script and reads repository file contents.\n
- Sanitization: Untrusted data is analyzed for metadata and semantic meaning but is not directly used in security-sensitive commands.
Audit Metadata