blame
Pass
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests untrusted data from git commit history via
git log. It lacks explicit boundary markers or instructions to ignore embedded commands within the commit messages, creating a surface for indirect prompt injection.\n - Ingestion points: Git commit history and author names retrieved in Step 4.\n
- Boundary markers: Absent; the instructions do not delimit the git log output from the agent's instructions.\n
- Capability inventory: Execute (for git commands), Read, Grep, LS, AskUser.\n
- Sanitization: Absent; the skill directly processes and narrates findings from the log.\n- [COMMAND_EXECUTION]: Uses the Execute tool to run standard git commands like
git logandgit config. These operations are consistent with the skill's purpose of analyzing repository history and are used within a controlled context.\n- [DATA_EXFILTRATION]: Provides a link for the user to manually share a report on X. This is a user-initiated action and does not involve automated or silent data exfiltration. References to author-controlled documentation at docs.factory.ai are included for user guidance.
Audit Metadata