kata-shipit
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as git diffs, file contents, and pull request metadata which can serve as vectors for indirect prompt injection.\n
- Ingestion points: Reads repository instructions, diffs, and pull request states in SKILL.md and references/local-commit.md.\n
- Boundary markers: Lacks specific data delimiters but follows a strict procedural sequence.\n
- Capability inventory: Performs git mutations and GitHub operations using cli tools (git, gh).\n
- Sanitization: Instructions require the agent to inspect diffs for credentials and use temporary files to prevent command injection via PR bodies.\n- [COMMAND_EXECUTION]: The skill interacts with the local system and remote servers via git and gh CLI tools. These operations are intended but represent a significant capability surface if manipulated by external input.
Audit Metadata