openharmony-ci
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script executes the
oh-gcCLI tool usingsubprocess.runto fetch pull request comments. The implementation uses a list of arguments and does not invoke a shell, which prevents command injection. - [EXTERNAL_DOWNLOADS]: The skill fetches build metadata and log artifacts from the official OpenHarmony domains
dcp.openharmony.cnandcidownload.openharmony.cn. This behavior is expected and aligns with the skill's primary function. - [SAFE]: The Python script uses standard library modules to handle archive files (zip/tar) and parses log content in memory without risky file system operations. All external network communications target project-specific infrastructure.
Audit Metadata