prod-push
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands including
git,gh(GitHub CLI),npm, andcurlto manage the software development lifecycle, sync branches, and verify deployment status. - [COMMAND_EXECUTION]: Implements identity verification steps using
git configandgit logto ensure the agent is operating as the authorized user and to prevent local identity overrides. - [COMMAND_EXECUTION]: Automated monitoring of production health and deployment status is performed via
gh apicalls andcurlrequests to the production endpoint. - [PROMPT_INJECTION]: The instructions contain multiple internal safety constraints (e.g., 'Never push on your own', 'Only run this after the user explicitly told you to push') which act as guardrails against autonomous unauthorized actions.
- [SAFE]: Ingestion of data from external APIs and local logs is handled using structured parsing tools like
jq, which reduces the potential surface for indirect prompt injection from untrusted source data.
Audit Metadata