finish-branch

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides a structured workflow for merging, creating pull requests, or discarding git branches with an emphasis on accountability through decision records.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute local shell commands using git and the gh (GitHub) CLI. It explicitly addresses potential command injection risks by mandating proper quoting of variables (e.g., "<base-branch>") and reading potentially untrusted data from files (e.g., title.txt) rather than direct interpolation.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub for pushing code and creating pull requests. GitHub is a well-known service, and these operations are standard for a development-focused skill.
  • [DATA_EXFILTRATION]: No exfiltration of sensitive information was detected. The network operations are limited to authenticated git operations with the repository's configured origin.
  • [PROMPT_INJECTION]: No instructions attempting to override agent behavior or bypass safety guidelines were found. The skill uses clear, instructional language.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 07:59 AM
Security Audit — agent-trust-hub — finish-branch