agent-release-swarm
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines several lifecycle hooks (
pre_task,post_edit,post_task,notification) in the frontmatter that execute shell commands usingnpx ruv-swarm. - [EXTERNAL_DOWNLOADS]: The lifecycle hooks and example documentation execute
npx ruv-swarmwithout specifying a pinned version, causing the environment to fetch and run the latest package code from the npm registry at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill automates data pipelines that ingest external, untrusted content, exposing an indirect prompt injection surface.
- Ingestion points: External commit logs and pull request descriptions are retrieved via
gh apiandgh pr listcommands withinSKILL.md. - Boundary markers: The skill does not employ any explicit boundary markers, XML delimiters, or system instructions to encapsulate the untrusted
$COMMITSor$MERGED_PRSvariables. - Capability inventory: The environment retains sensitive tools and permissions, including repository file modification, pull request generation, build execution, and deployment trigger capabilities.
- Sanitization: Retrieved text blocks from commits and PRs are forwarded directly as command arguments (
--commits "$COMMITS") without validation or filtering.
Audit Metadata