git-commit-push-pr

Pass

Audited by Gen Agent Trust Hub on Apr 4, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses git and gh commands for version control operations. This is consistent with its stated purpose of automating commit and PR workflows.
  • [EXTERNAL_DOWNLOADS]: References external assets from img.shields.io and links to GitHub and Claude.com. These are well-known services or resources belonging to the skill's author.
  • [PROMPT_INJECTION]: The skill processes untrusted input from git diff and pull request metadata. It incorporates security measures to ensure this data does not lead to command injection or unintended agent behavior.
  • Ingestion points: Reads data from git diff, git log, and gh pr view (SKILL.md).
  • Boundary markers: Instructions are logically separated into clear steps with specific intent.
  • Capability inventory: File system modification via git and network communication via gh (SKILL.md).
  • Sanitization: Uses quoted heredocs ('EOF') to ensure that LLM-generated content is treated as a literal string by the shell, preventing command injection.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 4, 2026, 06:39 AM