git-pushing
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a bash script (
scripts/smart_commit.sh) to automate terminal commands. It executesgit add,git commit, andgit pushto manage the repository workflow. - [DATA_EXFILTRATION]: The automation script employs
git add ., which stages every modified and untracked file in the repository. This behavior presents a risk of unintentional data exposure, as sensitive files such as environment variables (.env), SSH keys, or local configuration secrets may be staged and pushed to a remote repository if they are not correctly defined in the.gitignorefile. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The skill ingests untrusted data from the local environment via
git diffcontent and staged file names to determine commit types and scopes. - Boundary markers: There are no boundary markers or 'ignore' instructions applied to the ingested diff text or filenames during processing.
- Capability inventory: The skill possesses the capability to write to the git history and perform network operations via
git push. - Sanitization: No sanitization or escaping is performed on the file names or diff content before they are processed by internal regex logic to generate commit messages.
Audit Metadata