validate-changes
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local
gitcommands (git diff --stat,git diff --cached, andgit commit) to retrieve project state and perform actions. This behavior is consistent with its stated purpose as a git automation tool. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user's staged files and interpolates it directly into a prompt for another agent, creating a risk that malicious code changes could override the evaluation process.
- Ingestion points:
SKILL.md(Step 2 and 3) reads the full output ofgit diff --cached, which includes arbitrary text from files staged for commit. - Boundary markers: The prompt template in
SKILL.md(Step 3) uses a simple "Changes:" header but lacks robust delimiters or explicit instructions for the evaluator agent to ignore instructions embedded within the diff content. - Capability inventory: The skill can execute shell commands (
git) and trigger downstream workflows via theTasktool (SKILL.md, Step 3 and 5). - Sanitization: No escaping, filtering, or validation is performed on the git diff output before it is passed to the evaluator agent.
Audit Metadata