write-contributing
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's primary purpose is automated documentation maintenance. It uses repository metadata (git branch names, manifest files like
package.json, and CI configurations) to populate a template forCONTRIBUTING.md. - [COMMAND_EXECUTION]: The skill uses
bashcommands viajq,grep, andgitto extract repository facts. These are restricted to specific, safe operations (e.g.,git symbolic-ref,gh repo view) defined in theallowed-toolsfrontmatter. All command snippets provided inREFERENCE.mdare standard POSIX shell scripts for configuration resolution and repository inspection. - [EXTERNAL_DOWNLOADS]: The skill references a remote schema URL (
https://raw.githubusercontent.com/TitusKirch/skills/main/tituskirch-skills.schema.json) for configuration validation. This is an informational reference to the author's own repository and does not involve remote code execution or untrusted downloads. - [CREDENTIALS_SAFE]: The skill includes an explicit guardrail to scan for secrets in setup steps (e.g.,
.envvalues) and replace them with placeholders before writing toCONTRIBUTING.md. - [DATA_EXFILTRATION]: No data exfiltration patterns were detected. The skill reads local repository configuration and writes to a single local file (
CONTRIBUTING.md). The network operations (e.g.,gh repo view) are used solely to derive repository metadata. - [PROMPT_INJECTION]: No prompt injection or behavior override patterns were detected. The skill uses a structured 'plan -> confirm -> apply' workflow to ensure user oversight.
Audit Metadata