kata-complete-milestone
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several shell commands for project management, including git for repository operations, gh for GitHub interactions, and npm test for verification. It also allows for the execution of arbitrary commands defined in the project configuration.
- Evidence: Found in SKILL.md steps 0, 7, and 8, as well as milestone-complete.md steps ensure_release_branch and close_github_milestone.
- [DYNAMIC_EXECUTION]: The workflow retrieves and executes shell commands from the project's local configuration file (.planning/config.json) using eval. These pre_release_commands are executed during the milestone completion process.
- Evidence: milestone-complete.md step release_workflow sub-step 4.5 using eval "$CMD".
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the project's git history (commit messages) and local phase summaries to generate changelogs, PR bodies, and git tags. This represents an indirect prompt injection surface where crafted commit messages could affect the agent's output.
- Ingestion points: git log calls in SKILL.md step 0.2 and milestone-complete.md step extract_accomplishments.
- Boundary markers: The skill does not implement specific delimiters to neutralize potential injection in ingested commit messages.
- Capability inventory: The skill possesses file write access, git tagging, and GitHub PR creation capabilities.
- Sanitization: Basic sed patterns are used to strip prefixes, but the main message content is preserved without further sanitization.
Audit Metadata