land-the-plane
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Git CLI commands to manage the code landing process. It specifically requires explicit pathspecs for staging and prohibits command chaining (e.g., '&&' after commits) to ensure each step is successful and visible.
- [DATA_EXFILTRATION]: Outbound network activity is limited to standard Git synchronization (pull/push) with the project's origin repository. This is a core requirement for the skill's purpose and does not exhibit unauthorized exfiltration characteristics.
- [PROMPT_INJECTION]: The skill ingests untrusted data from quality gate outputs and local developer logs ("scratchpad/corrections.log"). While this creates a surface for indirect prompt injection, the risk is mitigated by the skill's restricted operational scope and lack of high-privilege execution capabilities.
- [SAFE]: The skill demonstrates defensive design by mandating that all quality gates pass before any commit or push is made, and it requires verification of the remote state as the final completion step.
Audit Metadata