herdr-pre-release-audit
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it analyzes untrusted data from the repository's history and metadata.\n
- Ingestion points: Commit subjects and bodies from
git log, pull request data fromgh pr, and content from documentation files.\n - Boundary markers: No explicit markers are used to separate untrusted data from instructions.\n
- Capability inventory: The agent can execute shell commands (
git,just,nix) and write to files in the repository.\n - Sanitization: The skill does not specify any sanitization or validation of the retrieved text.\n- [COMMAND_EXECUTION]: The skill executes
git,just, andnixcommands. While standard, these tools execute logic defined in repository files (justfile,flake.nix), allowing for the execution of repo-defined code.\n- [COMMAND_EXECUTION]: There is a potential for command injection if the$1argument (intended as a git reference) is not properly validated before being interpolated into shell commands such asgit log ... <base>..HEAD. The prompt instructs the agent to check if it 'looks like a ref/tag', but this relies on the model's interpretation rather than programmatic validation.
Audit Metadata