finish-release
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user and passes it to powerful tools without visible sanitization.
- Ingestion points: User input is captured via the $ARGUMENTS placeholder in SKILL.md and passed to the workflow execution.
- Boundary markers: No delimiters or safety instructions are used to isolate the user-provided version string from the command execution context.
- Capability inventory: The skill has access to Bash with git and gh tools, as well as Read and Write file system access.
- Sanitization: There is no evidence of input validation or escaping for the $ARGUMENTS variable within the skill definition.
- [COMMAND_EXECUTION]: The skill's primary function involves executing shell commands via git and gh. This capability, when combined with direct interpolation of user input, poses a potential risk for command injection if the referenced pipeline file does not perform its own strict validation.
Audit Metadata