check-quality
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands including
grep,find, andghto identify testing, linting, and CI/CD configurations. - [REMOTE_CODE_EXECUTION]: The skill attempts to run
pnpm coverageornpm run coverage, which executes scripts defined in the repository'spackage.json. This is expected behavior for a quality audit tool interacting with a local codebase. - [PROMPT_INJECTION]: The skill identifies an indirect prompt injection surface by processing data from repository files and API responses.
- Ingestion points: Reads
package.json,tsconfig.json, and output from thegh apicommand. - Boundary markers: Absent.
- Capability inventory: Includes shell command execution and invocation of local scripts.
- Sanitization: No validation or sanitization is applied to the ingested data before it is used to generate findings.
Audit Metadata