update-submodule-changelog
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external repositories by reading CHANGELOG.md files and git log output within submodules. Malicious instructions embedded in these external files by third parties could attempt to influence the agent's behavior during the summarization and writing process. 1. Ingestion points: CHANGELOG.md files and git history in submodules under protocols, payments, and gcloud directories. 2. Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the ingested data as untrusted text rather than instructions. 3. Capability inventory: The skill has Write access to the local filesystem and execution access for Git commands. 4. Sanitization: The skill relies on a manual user review checklist at the end of the process rather than automated sanitization.
- [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute Git commands (status, log, tag, fetch, describe) to analyze submodule states. While these commands are standard for version control tasks, they involve interacting with external repository metadata and potentially remote servers during git fetch operations.
Audit Metadata