finishing-a-development-branch
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill interpolates variables like
<feature-branch>,<base-branch>, and<title>directly into shell commands (e.g.,git merge <feature-branch>,git checkout <base-branch>). If these values contain shell metacharacters such as semicolons, backticks, or command substitution markers, they could be used to execute arbitrary commands on the system. While the skill uses a quoted heredoc ('EOF') for the PR body, other command arguments remain vulnerable to injection. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect injection surface by ingesting data from the git environment and user-provided strings without sanitization.
- Ingestion points: Branch names retrieved via
git branchand user-provided PR titles/bullets inSKILL.md. - Boundary markers: Partially present; the skill uses a quoted heredoc (
'EOF') for the PR body to prevent expansion, but markers are absent for branch name variables in other shell commands. - Capability inventory: The skill possesses extensive shell execution capabilities, including
git,gh(GitHub CLI), and various language-specific test runners (npm,cargo,pytest). - Sanitization: Absent for branch names and PR titles, allowing potentially malicious strings to influence subprocess execution.
Audit Metadata