commit-and-push
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard Git, Bash, and PowerShell commands to manage local repository workflows, including inspecting status, staging files, and committing changes. These commands are integral to the skill's stated purpose.
- [DATA_EXPOSURE]: The instructions explicitly include a security check to identify and exclude sensitive files such as
.envfiles, credentials, and tokens from being staged or committed. - [INDIRECT_PROMPT_INJECTION]: The skill processes local repository data (e.g., git diffs and logs) which constitutes an attack surface for indirect prompt injection. However, the skill implements strict formatting rules (Conventional Commits) and focuses on generating text for review, minimizing the risk of automated exploitation.
- [SAFE]: The skill incorporates safety guardrails, such as checking for protected branches (main, master, etc.) and preventing accidental pushes to them, as well as requiring explicit user consent for force-pushing or automated PR creation.
Audit Metadata