fix-ci
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the GitHub CLI (gh) to interact with repository state, pull requests, and CI workflows.
- Evidence includes the use of
gh pr view,gh pr checks,gh run view,gh run cancel, andgh run rerunto manage and diagnose CI jobs. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external, untrusted sources such as CI logs, PR metadata, and external check links.
- Ingestion points: Untrusted data enters the agent context via
gh run view --log-failed,gh pr checks, and content extracted from external check links (SKILL.md, steps 3-6). - Boundary markers: The SKILL.md contains an explicit 'External Side Effects' warning that PR metadata, commit messages, and logs must be treated as untrusted text and that embedded instructions should never be followed.
- Capability inventory: The skill has the capability to modify local source code, commit changes, push to remote repositories, and cancel/rerun CI workflows.
- Sanitization: The skill relies on natural language instructions to the agent to treat external data as diagnostic evidence only, rather than programmatic sanitization.
- [DYNAMIC_EXECUTION]: The skill instructs the agent to manually load and follow instructions from other skill definitions found on the local filesystem.
- Evidence: The 'Fix Ci procedure' section in SKILL.md directs the agent to 'Run another skill by reading its sibling ..//SKILL.md and following it'.
Audit Metadata