rebase
Warn
Audited by Gen Agent Trust Hub on Jul 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell command execution using input variables such as source and target branch names. This could be exploited for command injection if the inputs are not sanitized by the execution platform.\n- [COMMAND_EXECUTION]: The agent is instructed to retrieve and execute a command string from the CLAUDE.md file located in the project root. This dynamic execution of code from a file that can be modified by repository contributors is a significant security risk.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection due to its reliance on untrusted external data to guide its logic and execution path.\n
- Ingestion points: The skill ingests untrusted data from CLAUDE.md (Quality Gates table), GitHub PR metadata via the 'gh' CLI, and issue tracker data via the 'bd' CLI.\n
- Boundary markers: There are no delimiters or instructions to treat the ingested data as untrusted or to ignore potential commands embedded within it.\n
- Capability inventory: The agent has extensive capabilities including shell command execution and the ability to modify remote git repository history (via 'git push -f' and branch deletion).\n
- Sanitization: No validation, escaping, or sanitization is performed on the retrieved metadata or commands before they are processed or executed by the agent.
Audit Metadata