commit-message
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs information retrieval tasks using established tools such as the GitHub CLI (
gh) andcurl. All operations are consistent with the skill's documented purpose of automating WordPress development workflows. - [COMMAND_EXECUTION]: The skill invokes
gh pr viewto extract metadata from pull requests andcurlto resolve contributor usernames by checking redirects onprofiles.wordpress.org. These commands are used solely for data retrieval from public or repository-scoped sources and do not interact with sensitive system files or credentials. - [DATA_EXFILTRATION]: Analysis of network operations shows that the skill only communicates with trusted platforms (GitHub) and official vendor infrastructure (WordPress.org). No private data or local secrets are targeted for extraction.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources like pull request descriptions and Trac tickets. While this constitutes an ingestion surface, the skill’s logic is limited to extracting specific identifiers (ticket numbers) and resolved usernames, which are then formatted into a static template, posing no significant risk of agent manipulation.
Audit Metadata