compare-gradle-builds
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
git rev-parse --abbrev-ref HEADto programmatically determine the current branch name when it is not explicitly provided by the user. This is a standard and benign use of local git tools to gather development context. - [INDIRECT_PROMPT_INJECTION]: The skill functions by ingesting external build data, task lists, and environment metadata via the Tuist MCP tools. While processing external data theoretically introduces an indirect prompt injection surface, the data in this case consists of structured build metrics (durations, cache hit counts, and task outcomes), which poses a negligible risk to the agent's logic or security boundaries.
Audit Metadata