extract-rule
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes Git diffs and commit messages which are untrusted external inputs. An attacker could embed malicious instructions in code comments or commit messages to manipulate the rules generated by the agent.
- Ingestion points: Git diffs and commit history retrieved via
git diff,git show, andgit statusinSKILL.md(Steps 1 and 2). - Boundary markers: The skill includes multiple mandatory human-in-the-loop confirmation steps (Steps 3, 5, and 8) which act as a safeguard, although there are no explicit instructions for the LLM to ignore embedded commands.
- Capability inventory: The agent has the ability to read arbitrary files via git commands and write to
docs/rules/and the repository's agent guide. - Sanitization: No automated filtering is present, but human review of the generated output is required before finalization.
Audit Metadata