release
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the repository's git commit history to generate changelogs and release notes. This creates a surface for indirect prompt injection if commit messages contain malicious instructions.
- Ingestion points: The skill reads commit messages via
git log <last-tag>..HEAD --onelinein SKILL.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present when processing the git log.
- Capability inventory: The skill has extensive capabilities including file system modification, shell command execution (
npm,git,gh), and network operations (pushing to GitHub and creating releases). - Sanitization: There is no evidence of sanitization or filtering for the commit messages before they are interpolated into the release process.
- [COMMAND_EXECUTION]: The skill relies on executing various shell commands to perform its core functions. These include
npm version,npm run bump,npm test,git commit,git push, andgh release create. While these are necessary for the skill's stated purpose of release management, they represent a significant capability tier that could be abused if the agent is compromised.
Audit Metadata