skills/tkersey/dotfiles/land/Gen Agent Trust Hub

land

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the GitHub CLI (gh) and Git to perform operations like fetching PR state, resolving review threads, and merging commits. These actions are restricted to the explicitly provided repository context and follow a strict match-head-commit policy.
  • [COMMAND_EXECUTION]: The test suite (tests/test_land.py) executes the local validation script (scripts/evaluate_preflight.py) using subprocess.run to verify the evaluator's logic across various PR states. This is a standard testing practice for CLI utilities.
  • [DYNAMIC_EXECUTION]: The unit tests use importlib to load the local preflight evaluator script as a module, allowing the test suite to directly invoke and verify internal functions without executing arbitrary or untrusted code.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes uv to execute its local Python script. uv is a well-known, high-performance Python package and project manager, used here to ensure a consistent execution environment for the preflight logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external pull requests, such as review comments. It mitigates potential injection risks by requiring individual, evidence-backed dispositions for each thread and using a fail-closed Python evaluator to validate the final PR state against a strict internal schema before authorizing any mutation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 05:42 AM