submit-stack-for-review
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is instructed to ingest instructions and verification commands directly from the target repository, which represents a surface for indirect instructions.
- Ingestion points: Repository instructions, verification commands, and PR metadata (SKILL.md).
- Boundary markers: Not explicitly defined for the data, but the skill is instructed to "Stop on denied operations, unsafe decisions, changed scope, or external head/base drift."
- Capability inventory: Git operations (fetch, rebase, push --force-with-lease) and execution of repository-local verification scripts (SKILL.md).
- Sanitization: The skill emphasizes diagnostic attributable causes and meaningful local verification but does not specify input sanitization for the repo-provided scripts.
- [COMMAND_EXECUTION]: The skill performs shell-level Git operations and local repository verification scripts. These are scoped to a specific repository and authorized GitHub capability, and include safety measures like using
--force-with-leaseto prevent overwriting unexpected remote changes.
Audit Metadata