flow-release
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONNO_CODE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and process untrusted external data which could contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: The agent is directed to read "pending changes" (Phase 1), "user-facing release notes from the real diff" (Phase 1), and "project's reproducibility/provenance policy" (Phase 2) from the repository files.
- Boundary markers: The instructions do not specify the use of delimiters (e.g., XML tags or triple quotes) or explicit instructions to ignore potentially malicious content within these external files.
- Capability inventory: While no specific tools are listed in the YAML frontmatter, the instructions imply the use of file system tools, version control (Git), and potentially build/package registry tools to complete the release process.
- Sanitization: There are no instructions provided for sanitizing or validating the content of the release notes or changelogs before they are processed or included in release records.
Audit Metadata