release-changelog
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests and processes untrusted content from external sources (git commits, changeset files, and pull request data) and uses it to generate documentation.
- Ingestion points: Repository data is retrieved via
git log,gh pr list, and local.changeset/*.mdfiles (SKILL.md, Step 2). - Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the content gathered from commits or PR descriptions.
- Capability inventory: The agent has the ability to write files to the local filesystem (
releases/vYYYY.MDD.P.md) and execute shell commands (git,gh,ls, and./scripts/release.sh). - Sanitization: While the skill instructs the agent to redact secrets and PII before sharing context with subagents (SKILL.md, Section 4), it does not explicitly sanitize the text for embedded instructions before generating the changelog artifact.
Audit Metadata