deploy-check
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to run existing project verification commands (linting, tests, builds). While this involves executing shell commands, it specifically restricts the agent to using defined project scripts and lockfiles rather than downloading external tools.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the repository, including diffs, lockfiles, and migration scripts.
- Ingestion points: Repository files, git diffs, staged content, and environment variable references.
- Boundary markers: None explicitly defined for isolating untrusted file content from instructions.
- Capability inventory: Execution of project verification commands (formatting/lint, tests, build) and file system read access across the release scope.
- Sanitization: The skill includes a specific instruction to not print discovered secret values, providing a level of output sanitization for sensitive data found during scans.
Audit Metadata