piv-commit
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute standard version control commands, including
git status,git diff, andgit add, to manage uncommitted changes. These operations are core to the skill's functionality and are performed locally. - [PROMPT_INJECTION]: The skill reads and follows instructions from a local file (
.claude/references/conventions.md), creating a surface for indirect prompt injection if that file's content is untrusted. - Ingestion points:
.claude/references/conventions.md(referenced in SKILL.md). - Boundary markers: Absent; the agent is instructed to let the file's rules override defaults.
- Capability inventory: Local
gitcommand execution for repository management. - Sanitization: None; the skill assumes the conventions file is an authoritative source of project rules.
Audit Metadata