finishing-a-development-branch
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data such as branch names, PR titles, and test verification steps which are interpolated into shell commands and PR templates.
- Ingestion points: Variable inputs such as
<base-branch>,<feature-branch>,<title>, and<verification steps>are sourced from the environment or user input and used in shell executions. - Boundary markers: The skill does not implement specific delimiters or instructions to ignore potential commands embedded within these inputs.
- Capability inventory: The skill possesses the capability to execute shell commands via
git,gh(GitHub CLI), and various package manager test runners (npm,cargo,pytest,go). - Sanitization: There is no evidence of explicit sanitization or validation of the branch names or metadata before they are used in command-line arguments.
- [COMMAND_EXECUTION]: The skill executes project-specific test suites and GitHub CLI commands.
- The skill dynamically determines which test runner to use based on the project type (e.g.,
npm test,cargo test). - It utilizes
gh pr createwith a heredoc (cat <<'EOF') to safely handle multi-line PR bodies, which is a best practice for preventing shell injection in that specific context.
Audit Metadata