test-commit-push-pr-clean
Pass
Audited by Gen Agent Trust Hub on Aug 21, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands for Git operations (status, add, commit, push, branch, worktree), GitHub CLI tasks (pr create), and package management (npm, yarn, pnpm, npx) to perform development tasks.
- [DYNAMIC_CONTEXT_INJECTION]: The skill utilizes the
!commandsyntax incommands/test-commit-push-pr-clean.mdto automatically executegit status,git worktree list,git log, andgit branchupon loading. This is used to provide the agent with immediate context regarding the state of the repository. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the local environment via
git diff,git status, andgit log. This represents a surface where a malicious repository could attempt to influence agent behavior through crafted commit messages or code diffs. However, the skill provides specific templates for its outputs (commits and PRs), which helps mitigate the risk of unintended instruction following. - [SAFE]: The
allowed-toolsconfiguration in the frontmatter restricts the agent's environment to specific commands and arguments, adhering to the principle of least privilege. No unauthorized network requests, credential harvesting, or obfuscation techniques were identified.
Audit Metadata