git-pushing

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local bash script scripts/smart_commit.sh which performs standard git operations: git add, git commit, and git push. These operations are limited to the current repository context and are consistent with the skill's stated purpose.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided commit messages which are interpolated into a shell script.
  • Ingestion points: The commit message provided by the user is passed as an argument to the script in SKILL.md.
  • Boundary markers: None present for the prompt interpolation.
  • Capability inventory: The skill has capabilities to modify the git index, create commits, and interact with the remote repository (scripts/smart_commit.sh).
  • Sanitization: The script uses double quotes "$MESSAGE" for interpolation, which prevents basic shell command injection but does not sanitize the content for downstream log or prompt consumption. Given the intended use as a developer tool, this is an acceptable surface.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:18 AM
Security Audit — agent-trust-hub — git-pushing