release-notes
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting and processing repository metadata.
- Ingestion points: The skill reads PR titles and labels via
gh pr listand commit messages usinggit log. - Boundary markers: Data is interpolated into Markdown list items within the
[Unreleased]section ofCHANGELOG.md. - Capability inventory: The skill utilizes shell execution (
git,gh) and file-write capabilities (CHANGELOG.md). - Sanitization: While it performs basic string manipulation (stripping prefixes and capitalization), it lacks explicit sanitization to prevent the agent from interpreting instructions embedded within PR titles or commit history.
- [COMMAND_EXECUTION]: The skill executes multiple local shell commands using
gitand the GitHub CLI (gh). These operations are necessary for its primary function of retrieving repository tags, commit history, and pull request data.
Audit Metadata