incubate

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides detailed shell scripts for the agent to execute git and GitHub CLI commands. These operations include cloning, branch management, worktree creation, and PR workflows, which are central to its stated purpose.\n- [EXTERNAL_DOWNLOADS]: The skill downloads source code from external GitHub repositories using ghq get and git fetch. These operations target the well-known and trusted github.com service and do not escalate the verdict.\n- [INDIRECT_PROMPT_INJECTION]: The skill accepts external inputs such as repository URLs, slugs, and task descriptions. It implements security best practices by validating slugs with git check-ref-format and sanitizing task descriptions via tr to prevent shell command injection or data corruption.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 06:00 AM
Security Audit — agent-trust-hub — incubate