rock-feedback
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
gitand thegh(GitHub CLI) to manage branches, commits, and the creation of issues and pull requests. These operations are essential for the skill's purpose of automating feedback submission. - [EXTERNAL_DOWNLOADS]: The skill interacts with the
xdlkc/rock-marketplacerepository on GitHub. This destination is consistent with the author's identity and the stated goal of the skill. GitHub is a well-known service, and the interaction involves standard API/CLI usage. - [PROMPT_INJECTION]: The skill handles untrusted user input by processing feedback into structured GitHub reports.
- Ingestion points: User descriptions of bugs or improvements (SKILL.md).
- Boundary markers: The skill uses structured Markdown templates and explicitly recommends quoted shell heredocs (
<<'EOF'). - Capability inventory: Execution of
gitandghshell commands. - Sanitization: Use of quoted heredocs prevents the shell from interpreting or expanding variables within the user-provided feedback, mitigating risks of indirect command injection.
Audit Metadata