finishing-a-development-branch
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard development and version control commands (git, npm, cargo, pytest, go test, gh cli). These operations are restricted to the local development environment and the project's configured remote repository.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data such as test suite outputs and commit history. While this presents a theoretical surface for indirect prompt injection if an attacker can control test output or commit messages, the risk is mitigated by the structured nature of the skill's flow and the requirement for user confirmation on critical steps.
- Ingestion points: Test suite output, git branch names, git commit lists, and git worktree lists.
- Boundary markers: The skill uses specific structured options (1-4) to limit the agent's decision space.
- Capability inventory: File system access via git, network access via git push/gh pr create, and subprocess execution for testing tools.
- Sanitization: The skill requires explicit manual confirmation ('discard') for branch deletion.
- [SAFE]: The skill implements safety-first patterns, such as refusing to proceed if tests fail and mandating human-in-the-loop confirmation for permanent data deletion. All network operations (git push, gh pr create) are standard developer workflows targeting the user's own repository infrastructure.
Audit Metadata