flag-and-release-change
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the git CLI to perform repository operations including cloning, fetching pull request data, and pushing code updates to remote branches.
- [DATA_EXFILTRATION]: The skill interacts with external repositories on GitHub to read source code and push modifications. It follows security best practices by delegating credential handling to the execution environment rather than managing tokens itself.
- [PROMPT_INJECTION]: The skill creates an attack surface for indirect prompt injection by reading and analyzing untrusted content from pull requests.
- Ingestion points: The agent uses
git diffand reads changed files in the cloned repository to understand the change (SKILL.md). - Boundary markers: There are no specific instructions or delimiters used to separate the PR content from the agent's logic.
- Capability inventory: The skill has the ability to commit and push changes back to the repository branch.
- Sanitization: No explicit sanitization or validation of the PR content is performed before processing.
Audit Metadata