ship-and-watch
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill instructs the agent to use local development tools (
forge shepherd) for monitoring PR status. There are no indications of data exfiltration, credential theft, or unauthorized network access. The use of internal tooling for status updates is a standard development practice. - [INDIRECT_PROMPT_INJECTION]: The skill presents an ingestion surface by reading and processing JSON output from the
forge shepherdtool to report PR status. - Ingestion points: The agent reads output from
forge shepherd <pr> --pull --jsonas described inSKILL.md. - Boundary markers: None are explicitly defined for the tool output.
- Capability inventory: The skill allows the agent to execute the
forge shepherdcommand and report findings to the user. - Sanitization: No explicit sanitization or filtering of the tool's JSON output is mentioned. While this constitutes a theoretical surface for indirect prompt injection via manipulated PR metadata, the impact is minimal as the skill's role is strictly informational.
Audit Metadata