land
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) and Git to perform operations like fetching PR state, resolving review threads, and merging commits. These actions are restricted to the explicitly provided repository context and follow a strict match-head-commit policy. - [COMMAND_EXECUTION]: The test suite (
tests/test_land.py) executes the local validation script (scripts/evaluate_preflight.py) usingsubprocess.runto verify the evaluator's logic across various PR states. This is a standard testing practice for CLI utilities. - [DYNAMIC_EXECUTION]: The unit tests use
importlibto load the local preflight evaluator script as a module, allowing the test suite to directly invoke and verify internal functions without executing arbitrary or untrusted code. - [EXTERNAL_DOWNLOADS]: The skill utilizes
uvto execute its local Python script.uvis a well-known, high-performance Python package and project manager, used here to ensure a consistent execution environment for the preflight logic. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external pull requests, such as review comments. It mitigates potential injection risks by requiring individual, evidence-backed dispositions for each thread and using a fail-closed Python evaluator to validate the final PR state against a strict internal schema before authorizing any mutation.
Audit Metadata