commit-push-pr
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted code content from the repository to generate commit messages and pull request descriptions. An attacker could potentially embed malicious instructions in code comments or diffs to influence the agent's behavior during the commit/PR process.
- Ingestion points: The agent reads staged changes using
git diff --stagedto analyze the nature of work. - Boundary markers: The instructions do not define specific delimiters or "ignore previous instructions" guards for the diff content.
- Capability inventory: The skill has access to the
Bashtool (for git/GitHub operations) and theEdittool (to modify files). - Sanitization: No escaping or validation is performed on the code content before it is processed by the LLM.
- [COMMAND_EXECUTION]: The quality check step uses shell piping that is sensitive to filenames. Specifically, the command
git diff --staged --name-only | xargs grepfails to use null-terminators (-zand-0). While primarily a reliability issue, filenames with special characters or spaces could lead to unexpected command behavior or argument injection during the automated cleanup phase.
Audit Metadata