commit-narrator
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted data from staged repository changes. Malicious code or comments within a diff could influence the agent's behavior during message generation.
- Ingestion points: The agent reads output from
git diff --stagedand a helper Python script referenced in SKILL.md. - Boundary markers: Absent. There are no instructions or delimiters to isolate the diff content from the agent's instructions or to warn against embedded commands.
- Capability inventory: The agent has access to the
Bashtool to execute shell commands and read project data. - Sanitization: Absent. The agent is directed to use the diff content directly to ground its rationale without prior filtering or escaping.
- [COMMAND_EXECUTION]: The skill executes a local Python script via the command line.
- Evidence: The skill instructions specify running
git diff --staged --binary | python3 scripts/narrate.py --diff -using the Bash tool.
Audit Metadata