write-contributing

Pass

Audited by Gen Agent Trust Hub on Aug 26, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill's primary purpose is automated documentation maintenance. It uses repository metadata (git branch names, manifest files like package.json, and CI configurations) to populate a template for CONTRIBUTING.md.
  • [COMMAND_EXECUTION]: The skill uses bash commands via jq, grep, and git to extract repository facts. These are restricted to specific, safe operations (e.g., git symbolic-ref, gh repo view) defined in the allowed-tools frontmatter. All command snippets provided in REFERENCE.md are standard POSIX shell scripts for configuration resolution and repository inspection.
  • [EXTERNAL_DOWNLOADS]: The skill references a remote schema URL (https://raw.githubusercontent.com/TitusKirch/skills/main/tituskirch-skills.schema.json) for configuration validation. This is an informational reference to the author's own repository and does not involve remote code execution or untrusted downloads.
  • [CREDENTIALS_SAFE]: The skill includes an explicit guardrail to scan for secrets in setup steps (e.g., .env values) and replace them with placeholders before writing to CONTRIBUTING.md.
  • [DATA_EXFILTRATION]: No data exfiltration patterns were detected. The skill reads local repository configuration and writes to a single local file (CONTRIBUTING.md). The network operations (e.g., gh repo view) are used solely to derive repository metadata.
  • [PROMPT_INJECTION]: No prompt injection or behavior override patterns were detected. The skill uses a structured 'plan -> confirm -> apply' workflow to ensure user oversight.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 26, 2026, 03:15 PM
Security Audit — agent-trust-hub — write-contributing