finishing-a-development-branch
Pass
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands to run test suites (e.g., npm test, pytest, go test) and git lifecycle commands (e.g., git merge, git worktree, git push). These operations are restricted to the local repository and the configured remote (origin).
- [SAFE]: The skill follows security best practices for development tools. It includes explicit verification steps, requires typed confirmation ('discard') before data deletion, and performs environment checks to ensure it does not remove worktrees it did not create.
- [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it executes project-controlled test scripts and processes repository metadata. Evidence chain: 1. Ingestion points: Local project test scripts and git configuration files. 2. Boundary markers: No explicit delimiters are used to wrap the output of test executions. 3. Capability inventory: Shell execution and git operations across SKILL.md. 4. Sanitization: No specific sanitization of test output is performed. This surface is characteristic of developer tooling and is assessed as safe given the skill's instructional constraints and lack of privilege escalation.
Audit Metadata