comprehend-change
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes repository data such as git diffs, commit logs, and decision records, which constitutes a surface for indirect prompt injection. This is mitigated by explicit instructions in
references/passive-data-safety.mddefining this content as 'passive data' and requiring the agent to ignore any embedded instructions. \n - Ingestion points: Data is ingested from
git diff,git ls-files, and files within.skills/decisions/. \n - Boundary markers: The skill uses
references/passive-data-safety.mdas a mandatory safety guideline. \n - Capability inventory: The skill executes local git commands and writes one HTML file to the filesystem. \n
- Sanitization: Instructions mandate escaping all repo-derived text for HTML/JS contexts and explicitly forbid adding script tags or external links based on ingested data.\n- [COMMAND_EXECUTION]: The skill uses local git commands (e.g.,
git diff,git ls-files,git rev-parse) to resolve the code range for analysis. These operations are standard for development agents and do not involve executing external or untrusted scripts.\n- [SAFE]: The generated HTML output is restricted to locations outside the project worktree (e.g.,$HOME/.local/shareor/tmp), preventing accidental source code modification or unauthorized persistence within the repository.
Audit Metadata