changelog
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted data from the project's git history. * Ingestion points: Commit hashes, messages, and diffs are read into the agent's context using git log and git show commands. * Boundary markers: Absent. There are no instructions or delimiters to help the agent distinguish between data and potential instructions within commit messages. * Capability inventory: The skill utilizes shell command execution (git log, git show) and file system write operations (modifying CHANGELOG.md). * Sanitization: None. External data from the repository history is processed without filtering or validation.
- [COMMAND_EXECUTION]: The skill performs shell execution using variables derived from the local CHANGELOG.md file. Specifically, the git log --oneline ..HEAD command interpolates a version tag extracted from the file's content, which could be exploited for command injection if an attacker can influence the contents of the changelog file.
Audit Metadata