brief
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard developer tools including
git,gh(GitHub CLI), andgt(Graphite CLI) to gather repository state, commit history, and pull request metadata. It also uses file system commands to create a.briefs/directory and write HTML files. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection (Category 8). It ingests untrusted data from the repository environment and interpolates it into the final HTML output, which is then opened in a browser.
- Ingestion points: The skill reads data from
git log(commit messages),gh pr view(PR descriptions and comments), andgh api(inline review comments). - Boundary markers: No specific delimiters or boundary markers are instructed to isolate the untrusted external data from the generated HTML structure.
- Capability inventory: The skill has the ability to read arbitrary repository files, write to the local file system, and execute shell commands via CLI tools.
- Sanitization: The instructions lack explicit requirements for HTML entity encoding or sanitization of the gathered text. If a commit message or PR comment contains malicious scripts (XSS), they could be executed when the generated brief is opened in the user's browser.
Audit Metadata