ss-create-branch
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands including
git(for fetching, branch creation, worktree management, and pushing),grep(to read repository preferences fromAGENTS.md),npm install, andgo mod downloadto manage project dependencies.\n- [EXTERNAL_DOWNLOADS]: Retrieves content from user-supplied URLs (requirement or document links) in Step 1 to derive branch slugs and summaries. This involves making network requests to third-party domains.\n- [REMOTE_CODE_EXECUTION]: Invokesnpm installwithin the project directory. This command can trigger arbitrary code execution if the repository contains maliciouspreinstallorpostinstallscripts in itspackage.json.\n- [PROMPT_INJECTION]: Identifies a surface for indirect prompt injection:\n - Ingestion points: External content fetched from requirement links or document URLs in Step 1 (SKILL.md).\n
- Boundary markers: Absent; the skill does not use delimiters or instructions to ignore embedded commands in the fetched content.\n
- Capability inventory: Extensive shell execution capabilities (
git,npm,go) and network access (git push, URL fetching) across the entire automated flow.\n - Sanitization: Fetched content is summarized to a 2-4 word slug, which reduces but does not eliminate the risk of the agent obeying instructions hidden in the source document.
Audit Metadata