commit-security-scan
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses Git and GitHub CLI tools (git diff, gh pr diff, git show) to retrieve code changes. These commands are necessary for its analysis functions and are used in a controlled manner.
- [SAFE]: The skill has a standard attack surface for indirect prompt injection because it ingests and processes untrusted code and pull request data.
- Ingestion points: Code diffs and pull request metadata retrieved via Git/GitHub CLI in Step 2 of SKILL.md.
- Boundary markers: None are explicitly defined in the instructions; the skill processes the code changes directly as text.
- Capability inventory: The skill can read file changes, write a findings file (security-findings.json), and invoke the related threat-model-generation skill.
- Sanitization: Not explicitly implemented in the instruction set.
- [SAFE]: A static analysis alert for a destructive system command (rm -rf /) was identified as a false positive. The string occurs within documentation examples in analysis-examples.md describing vulnerability patterns, not as an instruction for the agent to execute.
Audit Metadata