Skills
Navigate
skills/somnio-software/somnio-ai-tools/dora-metrics/Gen Agent Trust Hub

dora-metrics

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: Controlled use of subprocess.run in scripts/dora_metrics.py and tests/e2e/run_e2e.py for GitHub CLI and Git operations. All calls use list-based arguments to mitigate injection risks.
  • [PROMPT_INJECTION]: The skill processes untrusted PR metadata from the GitHub API, creating a surface for indirect prompt injection.
  • Ingestion points: Metadata is retrieved in scripts/dora_metrics.py.
  • Boundary markers: Absent in both scripts/dora_metrics.py and agents/report-writer.md.
  • Capability inventory: SKILL.md identifies Bash, Write, and Agent tools as available to the main agent.
  • Sanitization: No explicit validation or sanitization is performed on external strings before interpolation into agent prompts.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 12:40 AM
Security Audit — agent-trust-hub — dora-metrics