prospective-release-notes
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the dxs CLI tool, such as marketplace metadata and branch details. Since this data is sourced from an external registry, it could contain malicious instructions designed to manipulate the agent's output.
- Ingestion points: Output from dxs organization search, dxs organization app list, and dxs source branch list (SKILL.md).
- Boundary markers: None identified in the workflow to separate external data from system instructions.
- Capability inventory: Shell command execution via dxs and delegation to the release-notes-generator skill (SKILL.md).
- Sanitization: No explicit content sanitization or validation of the marketplace metadata is described.
- [DYNAMIC_EXECUTION]: The skill constructs shell commands by interpolating variables like ORG_NAME and APP_NAME directly into command strings. This pattern presents a command injection surface if inputs are not properly sanitized by the underlying execution environment.
- Evidence: Shell command templates in Step 1 (SKILL.md) using user-provided organization and application names.
- [COMMAND_EXECUTION]: The skill relies on executing the vendor's dxs CLI tool to perform marketplace queries and branch lookups. This is expected functionality for the skill's defined purpose.
Audit Metadata