commit-push
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes powerful shell commands to manage the git lifecycle.
- Evidence: Uses
git add -Ato stage all changes andgit pushto upload them to a remote repository inSKILL.md. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data from the local repository.
- Ingestion points: Reads file content changes via
git diffand previous commit history viagit loginSKILL.md. - Boundary markers: No specific boundary markers or instructions to ignore embedded commands within the code or history are present.
- Capability inventory: The agent has the capability to stage all files, create new commits, and push data to remote servers as defined in
SKILL.md. - Sanitization: There is no evidence of sanitization or filtering of the content ingested from the repository before the agent analyzes it to generate commit messages.
Audit Metadata