repo-cleanup-loop
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, creating a potential surface for injection through manipulated branch names or pull request metadata.
- Ingestion points: Repository state scans using
git branch -vvand pull request listings viagh pr list(references/cleanup-algorithm.md). - Boundary markers: The skill uses a structured JSON inventory (
.claude/repo-cleanup-inventory.json) to track and classify items, isolating external data from the primary instruction flow. - Capability inventory: The skill utilizes the
Bashtool to perform repository modifications, including destructive actions like branch deletion and worktree removal. - Sanitization: Removal eligibility is determined by objective git evidence (e.g.,
git branch --mergedresults) and empty diff checks rather than interpreting the text of PR titles or branch names. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute git repository maintenance commands, including the deletion of local and remote branches and worktrees. - Evidence-gated removal: No items are removed without verifiable evidence of being merged or recovered, and the skill defaults to human confirmation for any ambiguous items.
Audit Metadata