merge-discipline
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes git, gh, and glab commands to manage branches, check for conflicts, and perform merges. It also runs a local Python script (analyze_coverage.py) for coverage analysis. These operations are core to the skill's purpose and are conducted through standard platform CLI tools.
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to the user for installing missing dependencies from the author's public repository (FuDesign2008/open-skills) using the npx skills command.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted PR/MR metadata to determine whether a full or light code review is required during Part R. \n
- Ingestion points: Metadata is retrieved from pull request titles, descriptions, and commit messages via gh pr view, glab mr view, and git log. \n
- Boundary markers: There are no defined boundary markers or explicit instructions to the agent to treat this PR metadata as untrusted data separate from its primary instructions. \n
- Capability inventory: The skill possesses significant capabilities, including rebasing branches, performing force-pushes to source branches, and executing merge commands on the target platform. \n
- Sanitization: The instructions do not define any sanitization or escaping mechanisms for the metadata strings before they are evaluated against keywords or path classification lists.
Audit Metadata