project-change-log
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
rotate_changelog.pyto archive old changelog entries. This script is included with the skill and uses only standard library modules to perform file I/O within the project directory. - [PROMPT_INJECTION]: The skill processes external data from commit messages and existing changelog files, creating a surface for indirect prompt injection.
- Ingestion points: Existing
CHANGELOG.mdfiles and git commit history. - Boundary markers: The skill relies on standard Markdown structure (headers and lists) as delimiters.
- Capability inventory: The skill can read and write to the local file system and execute the bundled Python rotation script.
- Sanitization: No explicit sanitization or escaping of external content is specified beyond formatting instructions for the agent.
Audit Metadata