incremental-diff-ingestion
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides CLI commands and a Python function implementation that execute
git diffthrough thesubprocessmodule. The Python code uses argument lists rather than shell strings, which is a secure method that prevents shell injection vulnerabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external data from Git diffs into the agent's context, creating a potential surface for indirect prompt injection from malicious content within Pull Requests or commits.\n - Ingestion points: Git diff output is captured in
SKILL.md(viadiff_res.stdout) and passed to the agent context.\n - Boundary markers: The implementation uses textual headers (e.g.,
=== UNIFIED DIFF ===) to separate content, but lacks robust delimiters to prevent the agent from obeying instructions embedded in the diff.\n - Capability inventory: The skill invokes the
gitbinary usingsubprocess.runas documented inSKILL.md.\n - Sanitization: No sanitization or filtering is applied to the diff output before ingestion.
Audit Metadata