workflow-git-commit

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses standard Git commands (git add, git diff, git commit, git status) that are appropriate for its purpose. It provides specific instructions to avoid dangerous variations like git add . or git add -A.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git diff and git status. While this data could contain malicious instructions, the skill mitigates risk by using a quoted heredoc ('EOF') in the commit command, which prevents the shell from executing code embedded in the commit message text. Ingestion occurs in SKILL.md via diff commands; capabilities are limited to local commits; and explicit boundary instructions are provided to the agent to prevent unauthorized file access.
  • [DATA_EXFILTRATION]: The skill explicitly forbids network operations such as git push or opening Pull Requests, ensuring that code and metadata remain within the local environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 05:56 AM
Security Audit — agent-trust-hub — workflow-git-commit