commit-and-pr
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions are focused on standardizing Git and GitHub workflows according to specified contributor guidelines. All commands and tools are used for their intended purpose.
- [DATA_EXPOSURE]: The skill explicitly advises against using
git add -Ato prevent accidental staging of sensitive local files, credentials, or dotfiles, which is a positive security practice. - [COMMAND_EXECUTION]: Tool usage is restricted to Git and GitHub CLI binaries through the allowed-tools configuration, which aligns with the skill's stated purpose of repository management.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (PR templates and PR metadata) to guide standard repository actions. While this is a common attack surface, the risk is assessed as safe as the skill uses a restricted toolset for administrative tasks and follows established developer workflows.
Audit Metadata