release-notes
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
$ARGUMENTSplaceholder to dynamically constructgitcommands (e.g.,git log $LAST_TAG..HEAD). This creates a surface for command injection if the user-supplied range or tag contains shell metacharacters that are not sanitized by the execution environment.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection by ingesting untrusted content from git commit messages and GitHub pull request descriptions.\n - Ingestion points: Commit history fetched via
git logand pull request metadata fetched viagh api.\n - Boundary markers: None. The skill does not use delimiters or instructions to prevent the model from following commands embedded in the ingested data.\n
- Capability inventory: The agent executes shell commands (
git,gh) and interacts with the repository's files.\n - Sanitization: No filtering or sanitization is performed on the ingested text before the model processes it for transformation.
Audit Metadata