commit-push-close

Pass

Audited by Gen Agent Trust Hub on May 20, 2026

Risk Level: SAFEPROMPT_INJECTION
Full Analysis
  • [SAFE]: The skill implements a robust security filter that prevents the agent from staging files containing sensitive data patterns, including .env, .pem, .key, and SSH keys. It also mandates staging files explicitly by path rather than using broad commands like git add ., which reduces the risk of accidental data exposure.
  • [COMMAND_EXECUTION]: The skill uses Git and GitHub CLI for workflow automation. It leverages quoted HEREDOCS (<<'EOF') for commit messages and explicitly instructs the agent to escape shell-sensitive characters (backticks and dollar signs) when generating comments. These practices significantly mitigate the risk of shell command injection from untrusted file content.
  • [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it reads and processes untrusted data (git diffs, commit logs, and GitHub issue content) to draft messages and test plans. However, the risk is mitigated by design:
  • Ingestion points: Untrusted data enters via git diff, git log, and gh issue view (SKILL.md).
  • Boundary markers: While explicit markers aren't used for diff content, the instructions require the agent to draft content and present it for user review.
  • Capability inventory: The skill possesses file-write (commit), network (push), and API (issue create/close) capabilities (SKILL.md).
  • Sanitization: The skill requires a mandatory human review and approval step (Step 6) for all drafted content before any destructive or external actions are performed, providing a critical safety check against malicious instructions embedded in processed data.
Audit Metadata
Risk Level
SAFE
Analyzed
May 20, 2026, 07:31 PM
Security Audit — agent-trust-hub — commit-push-close