commit-push-close
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a robust security filter that prevents the agent from staging files containing sensitive data patterns, including .env, .pem, .key, and SSH keys. It also mandates staging files explicitly by path rather than using broad commands like
git add ., which reduces the risk of accidental data exposure. - [COMMAND_EXECUTION]: The skill uses Git and GitHub CLI for workflow automation. It leverages quoted HEREDOCS (
<<'EOF') for commit messages and explicitly instructs the agent to escape shell-sensitive characters (backticks and dollar signs) when generating comments. These practices significantly mitigate the risk of shell command injection from untrusted file content. - [PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection because it reads and processes untrusted data (git diffs, commit logs, and GitHub issue content) to draft messages and test plans. However, the risk is mitigated by design:
- Ingestion points: Untrusted data enters via
git diff,git log, andgh issue view(SKILL.md). - Boundary markers: While explicit markers aren't used for diff content, the instructions require the agent to draft content and present it for user review.
- Capability inventory: The skill possesses file-write (commit), network (push), and API (issue create/close) capabilities (SKILL.md).
- Sanitization: The skill requires a mandatory human review and approval step (Step 6) for all drafted content before any destructive or external actions are performed, providing a critical safety check against malicious instructions embedded in processed data.
Audit Metadata