branch-creator
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill prevents shell command injection by enforcing a limited character set (a-z, 0-9, and hyphens) and utilizing git check-ref-format --branch as a validation gate for all generated branch names.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to generate branch names for shell execution, presenting a potential injection surface. Documentation:
- Ingestion points: User-provided task descriptions processed in SKILL.md.
- Boundary markers: Explicit instructions to avoid shell metacharacters and a 20-character maximum length for slugs.
- Capability inventory: Execution of local Git commands including git status and git switch -c.
- Sanitization: Mandatory validation of the final branch name string using git check-ref-format before execution.
Audit Metadata