tomtom-maps-sdk-js-feedback
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh) to search for existing issues and submit feedback reports to the official repository of the vendor (tomtom-international/maps-sdk-js). These actions are limited to the intended feedback workflow and utilize the user's existing authenticated session.\n- [DYNAMIC_EXECUTION]: Employs a short Node.js script to URL-encode the contents of report drafts for manual submission fallback links. This execution is restricted to a hardcoded utility pattern and does not run untrusted or external code.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as SDK documentation, error messages, and project source code, which could contain adversarial instructions. This risk is mitigated by a mandatory human-in-the-loop review process where the user must explicitly approve the final draft before any data is transmitted.\n - Ingestion points: SDK documentation, error logs, symbol names, and project source code.\n
- Boundary markers: Step 5 of the skill requires a manual "yes" from the developer to approve the exact draft being sent.\n
- Capability inventory: File reading (
Read), shell access (Bash), and authenticated network operations via the GitHub CLI.\n - Sanitization: Includes a comprehensive redaction checklist in
docs/posting.mdto ensure that API keys, personal data, and proprietary business logic are removed from feedback reports.
Audit Metadata