git-pushing
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local bash script
scripts/smart_commit.shwhich performs standard git operations:git add,git commit, andgit push. These operations are limited to the current repository context and are consistent with the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided commit messages which are interpolated into a shell script.
- Ingestion points: The commit message provided by the user is passed as an argument to the script in
SKILL.md. - Boundary markers: None present for the prompt interpolation.
- Capability inventory: The skill has capabilities to modify the git index, create commits, and interact with the remote repository (
scripts/smart_commit.sh). - Sanitization: The script uses double quotes
"$MESSAGE"for interpolation, which prevents basic shell command injection but does not sanitize the content for downstream log or prompt consumption. Given the intended use as a developer tool, this is an acceptable surface.
Audit Metadata