finalize
Warn
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill instructions override standard interaction protocols by directing the agent to "Automatically accept safe, in-scope fixes" and "Do not ask the user to accept each safe cleanup change." This behavior reduces human oversight over automated code modifications and commits.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the processing of repository diffs.
- Ingestion points: Untrusted data enters the agent context via
git diffof the feature branch. - Boundary markers: Absent. The subagent prompts do not include delimiters or instructions to ignore commands embedded within code comments in the diff.
- Capability inventory: The agent can execute shell commands (validation tools) and perform file system writes through
git commit. - Sanitization: None. The repository content is directly processed by LLM subagents without filtering.
- [COMMAND_EXECUTION]: The skill discovery and execution of validation commands (e.g., lint, test, typecheck) from the repository environment could be exploited if malicious configurations are present in the codebase.
Audit Metadata