add-change
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes data from code diffs and user input, which represents an indirect injection surface. Ingestion points: git diff output, git diff --cached output, and user-provided descriptions via $ARGUMENTS. Boundary markers: The instructions do not define explicit boundary markers or delimiters to isolate untrusted data. Capability inventory: The agent has access to Bash for command execution and Write for file creation. Sanitization: The instructions prompt the agent to logically summarize changes rather than direct pass-through, though no explicit shell escaping is mandated.
- [COMMAND_EXECUTION]: The skill uses shell commands to automate development workflows. It utilizes git for change detection and the bumpy CLI (a tool associated with the vendor dmno-dev) for managing versioning metadata locally.
Audit Metadata