ci-speedup
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill employs
subprocess.runacross several components likerun.pyandscan.pyto coordinate local scripts and execute the officialghCLI. These operations are scoped to the skill's local directory and verified external tools. - [EXTERNAL_DOWNLOADS]: The data pass fetches CI run history and job logs from GitHub via the
ghtool. These downloads are performed over a trusted service domain and are essential for the tool's diagnostic and measurement functions. - [PROMPT_INJECTION]: The skill anticipates indirect prompt injection from third-party CI logs and mitigates the risk by providing clear instructional boundaries to the agent in
SKILL.mdand by implementing sanitization functions such as_fence_safeto neutralize potentially malicious formatting in generated reports.
Audit Metadata