skills/starslingdev/skills/ci-speedup/Gen Agent Trust Hub

ci-speedup

Pass

Audited by Gen Agent Trust Hub on Jul 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill employs subprocess.run across several components like run.py and scan.py to coordinate local scripts and execute the official gh CLI. These operations are scoped to the skill's local directory and verified external tools.
  • [EXTERNAL_DOWNLOADS]: The data pass fetches CI run history and job logs from GitHub via the gh tool. These downloads are performed over a trusted service domain and are essential for the tool's diagnostic and measurement functions.
  • [PROMPT_INJECTION]: The skill anticipates indirect prompt injection from third-party CI logs and mitigates the risk by providing clear instructional boundaries to the agent in SKILL.md and by implementing sanitization functions such as _fence_safe to neutralize potentially malicious formatting in generated reports.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 22, 2026, 09:31 AM
Security Audit — agent-trust-hub — ci-speedup