nx-ci-monitor
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill employs dynamic context placeholders to capture the current branch, commit hash, and repository status using standard git commands (!
git branch --show-current, !git rev-parse --short HEAD, and !git status -sb | head -1) during skill initialization.- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data from CI task summaries and subagent fix suggestions, which influences its subsequent remediation actions. - Ingestion points: The agent ingests
suggestedFix,suggestedFixReasoning, andtaskOutputSummaryfrom theci-watchersubagent. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat this data as untrusted or to ignore embedded commands.
- Capability inventory: The skill is capable of performing
git commit,git push, andnxtask execution. - Sanitization: There is no evidence of sanitization or validation of the ingested CI summaries before they are processed by the agent logic.- [COMMAND_EXECUTION]: The skill performs automated shell commands using
git,nx,pnpm,yarn, andnpmto manage the local workspace and interact with CI pipelines.- [EXTERNAL_DOWNLOADS]: The skill uses thenx apply-locallycommand to fetch and apply patches from Nx Cloud via generated shortlinks.
Audit Metadata