flow-git-fix
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform various Git operations, including reading repository status, history, and reflogs, as well as modifying the repository state through merges, rebases, cherry-picks, and branch cleanups. It specifically recommends safer alternatives like
git push --force-with-leaseand warns against destructive routine actions such asreset --hardorclean -fd. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external repositories, specifically Git history and conflict markers within source code. This represents a vulnerability surface where malicious instructions could be embedded in the repository content to influence agent behavior.
- Ingestion points: Git conflict markers, repository history, reflogs, and branch metadata (SKILL.md).
- Boundary markers: Relies on standard Git conflict delimiters (e.g.,
<<<<<<<,=======,>>>>>>>) to identify conflicting regions. - Capability inventory: The skill allows file modification, local Git command execution, and remote pushes (Phase 2, Phase 3).
- Sanitization: No explicit sanitization or filtering of the repository data is described; however, the skill mandates manual inspection and confirmation of behavior before finalizing changes.
Audit Metadata