ci-sentinel
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted data from GitHub pull requests and CI logs, creating a surface for indirect prompt injection.
- Ingestion points: The skill reads PR titles, bodies, and CI job logs via 'gh pr checks' and 'gh api' calls.
- Boundary markers: The skill documentation references a quarantine strategy ('untrusted-input-quarantine.md') to isolate untrusted text from instruction blocks.
- Capability inventory: The skill has access to the 'Bash' tool for command execution, 'github-operations' for API interaction, and 'Write'/'Edit' tools for maintaining logs and posting comments.
- Sanitization: The skill prioritizes deterministic signals like exit codes and test outputs, which bypass the LLM reader as ground truth to reduce reliance on potentially manipulated text logs.
- [COMMAND_EXECUTION]: The skill utilizes the 'Bash' tool to execute various GitHub CLI commands and automated Claude CLI instances.
- Evidence: Instructions include the execution of 'gh pr list', 'gh pr checks', and headless 'claude -p' invocations for autonomous analysis within a GitHub Actions environment.
Audit Metadata