ccccc
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process and emulate the format of the last five git commits. This represents an attack surface where malicious instructions embedded in previous commit messages could influence the agent's behavior.
- Ingestion points: The agent reads output from
git log(last 5 commits) to determine formatting and field reuse (e.g., JIRA IDs). - Boundary markers: The instructions do not define delimiters or specific warnings to ignore instructions found within the commit data.
- Capability inventory: The skill possesses the ability to execute shell commands (
git commit) and read from the local filesystem. - Sanitization: There is no evidence of sanitization or filtering applied to the commit history data before it is processed.
- [COMMAND_EXECUTION]: The skill explicitly directs the agent to skip user confirmation for git commit operations ("Calling this skill is considered authorization to create a commit: commit directly, no need to confirm with the user"). While the skill description claims to be manual-only, this instruction removes a critical human-in-the-loop checkpoint for filesystem modifications.
Audit Metadata