git-ai-search
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the retrieval of AI conversation history stored within git repositories. This process creates a surface for indirect prompt injection, as an attacker with write access to a repository could commit malicious instructions masquerading as legitimate conversation logs. When a developer restores this context, the AI agent might inadvertently follow those injected instructions.
- Ingestion points: Data is ingested from git logs and metadata through the
git-ai searchandgit-ai continuecommands, specifically within theSKILL.mdworkflows. - Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between the skill's operational instructions and the potentially untrusted conversation history it retrieves.
- Capability inventory: The skill is granted access to the
Bash(git-ai:*)tool and can spawn new agent sessions with retrieved context using the--launchflag. - Sanitization: The skill does not describe any mechanisms for sanitizing or validating the integrity of the conversation data pulled from the git history.
Audit Metadata