ci-sentinel
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONPERSISTENCE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input from GitHub PR titles, bodies, and CI logs to perform its analysis. \n
- Ingestion points: Fetches external content using
gh pr listand log retrieval commands. \n - Boundary markers: Mentions the use of untrusted-input quarantine rules and structured extraction. \n
- Capability inventory: Uses the Bash tool to interact with GitHub APIs and post PR comments. \n
- Sanitization: Employs a 'propose-don't-apply' strategy and uses restricted GITHUB_TOKEN scopes to prevent unauthorized code changes. \n- [COMMAND_EXECUTION]: Employs the Bash tool to execute
ghCLI commands for repository status monitoring and secret management. \n- [PRIVILEGE_ESCALATION]: Configures the agent to operate in--permission-mode acceptEdits, enabling automatic tool execution without user prompting for its headless runs. This is documented alongside mitigations regarding GitHub Action permission limits. \n- [PERSISTENCE]: Enables a recurring GitHub Actions cron job for autonomous operation, allowing the agent to run tasks at scheduled intervals without direct human invocation.
Audit Metadata