monthly-project-update
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill correctly implements its stated functionality for aggregating project activity. No malicious code, obfuscation, or unauthorized network operations were detected.
- [COMMAND_EXECUTION]: The helper script
scripts/collect-git-activity.jsexecutes thegitcommand to retrieve repository data. This execution is performed usingexecFileSyncwith argument arrays, which is a secure method for executing system commands for the skill's primary purpose. - [PROMPT_INJECTION]: The skill processes untrusted content from git commit logs and issue trackers to generate summaries.
- Ingestion points: Commit subjects collected via
scripts/collect-git-activity.js, and PR/MR titles and ticket descriptions fetched via external tools as described inreferences/data-sources.md. - Boundary markers: None. The skill does not instruct the agent to use specific delimiters when processing retrieved text.
- Capability inventory: File system write access for saving reports to the
project-updates/directory and shell command execution via the bundled git script. - Sanitization: None. There are no explicit instructions to validate or sanitize the incoming text data before incorporation into the report.
Audit Metadata