quality-gates-enforcer
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (LOW): The skill references several third-party GitHub Actions (e.g., romeovs/lcov-reporter-action, andresz1/size-limit-action, snyk/actions/node) that are not part of the explicitly trusted organizations. While standard in many CI setups, they represent external dependencies and some use mutable branch references like @master.
- [COMMAND_EXECUTION] (LOW): The provided YAML templates execute shell commands such as npm ci, npm audit, and npx tsc which involve downloading and executing code from package registries during the build process.
- [PROMPT_INJECTION] (LOW): The skill contains a surface for indirect injection (Category 8). The actions/github-script step reads a locally generated file (quality-report.md) and interpolates its content directly into a PR comment body without sanitization. Ingestion points: quality-report.md read in SKILL.md. Boundary markers: Absent. Capability inventory: github.rest.issues.createComment (PR communication). Sanitization: Absent.
Audit Metadata