creating-a-changeset
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository, creating a surface for indirect instructions to influence agent actions.
- Ingestion points: The workflow instructs the agent to read
AGENTS.md,CONTEXT.md, contributor guides, and git output (git diff,git status) to determine the scope of changes. - Boundary markers: No delimiters or specific safety instructions are provided to separate the ingested content from the skill's own instructions.
- Capability inventory: The agent is permitted to write new files to the
.changeset/directory and execute local shell commands via package managers (e.g.,npm exec,pnpm exec). - Sanitization: The skill does not include steps to sanitize or filter the ingested data before it is processed by the agent.
Audit Metadata