commit-cloud
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute specific local scripts,
scripts/commit-cloudandscripts/pull, to manage the backup and restoration of development work. These are assumed to be part of the user's project environment. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the synchronization of external repository data, which represents an ingestion surface for untrusted content.
- Ingestion points: Content is pulled from a remote repository into the local
.commit-cloud/directory during restoration. - Boundary markers: No specific delimiters or "ignore instructions" warnings are mentioned for the data being restored.
- Capability inventory: The skill performs file system writes and network operations via its backup and pull scripts.
- Sanitization: No explicit sanitization or verification of the metadata or commit content within the synchronized stacks is described.
Audit Metadata