finishing-a-development-branch
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a variety of shell commands and development tools, including
gitfor branch management,ghfor GitHub interactions, and language-specific test runners likenpm,cargo,pytest, andgoto verify implementation quality. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection attack surface by interpolating external project data (specifications and plans) into the body of Pull Requests via the
gh pr createcommand. While this is the intended primary purpose of the skill, it creates a vector where malicious content in a project plan could be propagated to external platforms. - Ingestion points: Project specifications and plan data are ingested and interpolated into the PR description in
SKILL.md(Step 3 and Step 4). - Boundary markers: The implementation uses a shell heredoc (
EOF) for interpolation but does not provide specific instructions to the agent to ignore or delimit potentially executable prompts within the external data. - Capability inventory: The skill possesses capabilities for shell command execution (
git,npm) and network-facing operations (git push,gh pr create). - Sanitization: No explicit sanitization or content validation is performed on the plan data before it is passed to the shell or the GitHub API.
Audit Metadata