ss-cleanup
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute several shell commands using Git and official forge tools (gh for GitHub, glab for GitLab). These operations include fetching updates, checking PR status, merging branches, switching branches, and removing worktrees. While some operations are destructive (e.g., branch deletion and worktree removal), the skill specifies logic to detect uncommitted changes and requires user confirmation or explicit flags (--force) before proceeding, which aligns with standard development best practices.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it reads and processes external metadata from the repository environment.
- Ingestion points: Data enters the agent's context through current branch names, repository worktree lists, and PR/MR state information retrieved from GitHub or GitLab (SKILL.md).
- Boundary markers: Absent; the skill does not define specific delimiters or instructions to ignore potential commands embedded within branch names or PR descriptions.
- Capability inventory: The skill has the capability to perform file-system modifications (worktree removal) and remote repository changes (branch deletion and merging) based on the ingested data.
- Sanitization: The skill lacks explicit sanitization for external data, relying instead on the agent's reasoning and explicit user confirmation steps for sensitive actions.
Audit Metadata