shipping-changes
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides instructional guidelines for standard git workflows, including commit formatting and pull request documentation. It promotes best practices like batching commits and using conventional commit formats.
- [SAFE]: The skill includes security-positive instructions to ensure secrets like
.envfiles, keys, and tokens are not staged or pushed to remote repositories. - [INDIRECT_PROMPT_INJECTION]: The skill operates on repository data (git diffs and files) which serves as a potential ingestion point for untrusted content if external code or contributions are processed.
- Ingestion points: Project source code and git diffs processed during commit and PR generation (implied by the skill's purpose).
- Boundary markers: Absent in the instructions.
- Capability inventory: Git CLI tools (commit, push, stage).
- Sanitization: No specific sanitization instructions for untrusted content within the repository.
Audit Metadata