meticulous-fix
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests instructions from external Meticulous review comments and automated fix prompts, which introduces a surface where external content could influence the agent's actions during code modification.
- Ingestion points: External instructions and metadata are retrieved via the
meticulousCLI and MCP tools, specifically through commands such asget_test_run_diffs,get_diff_comments, andget_agent_swarm_run_caseinSKILL.md. - Boundary markers: The skill does not implement explicit delimiters or specific instructions to isolate external data from the agent's core operational logic.
- Capability inventory: The agent is granted capabilities to modify source code, perform
gitoperations (commit, push), and interact with pull request management tools (gh,glab). - Sanitization: The skill instructions do not specify a process for validating or sanitizing the content retrieved from the external Meticulous platform before it is used to drive code changes.
- [COMMAND_EXECUTION]: The skill employs various command-line interfaces to perform its defined tasks.
- It uses
gitfor version control operations, including committing changes with specific trailers and pushing to remote branches. - It interacts with GitHub (
gh), GitLab (glab), and Bitbucket for pull request communication. - It utilizes the
meticulousCLI for interacting with the Meticulous testing service. - [EXTERNAL_DOWNLOADS]: The skill fetches data and configuration from external sources during its workflow.
- It retrieves test run diffs, check reports, and image assets from the
meticulous.aiandapp.meticulous.aidomains. - It references the
meticulous-cli-updateskill for maintaining its tooling.
Audit Metadata