org-ci-health
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes an external shell script at a hardcoded local path:
~/.claude/scripts/org-ci-health.sh. Since this script is not bundled with the skill files, its contents and security properties cannot be verified, posing a risk if the environment is compromised or the script is replaced by a malicious actor. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Git repositories which can lead to indirect prompt injection.
- Ingestion points: The skill parses JSON data containing repository names and GitHub Action workflow definitions (the
actions_usedfield) extracted from remote repositories. - Boundary markers: Absent. There are no instructions to the agent to treat the ingested workflow content as untrusted or to use delimiters to separate data from instructions.
- Capability inventory: The agent is authorized to perform write operations, including creating worktree branches, applying code fixes, and creating Pull Requests on GitHub.
- Sanitization: Absent. The skill lacks instructions to validate or sanitize the strings retrieved from the repositories before they are used to drive the agent's logic in Phase 2 and 3.
- [PROMPT_INJECTION]: The skill uses high-priority instructional markers ("IMPORTANT") to dictate session control-flow, specifically instructing the agent to "automatically exit after completing all phases." This overrides standard interactive review or default agent exit protocols, potentially reducing user oversight of the actions performed.
Audit Metadata