commit-push
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface
- Ingestion points: The skill ingests data from the local repository using
git status,git diff, andgit login Step 0 and Phase 1, and retrieves metadata viagh pr listin Phase 2. - Boundary markers: Absent. There are no instructions to delimit or ignore instructions that might be embedded in the repository content (e.g., in diffs or commit messages).
- Capability inventory: The skill has significant capabilities, including staging files (
git add), creating commits (git commit), and pushing to remote repositories (git push). - Sanitization: Absent. Repository content is analyzed and potentially used to generate commit messages without explicit sanitization.
- [COMMAND_EXECUTION]: Version Control Operations
- The skill executes shell commands using
gitandgh. It follows security best practices by requiring user confirmation before critical actions and avoiding automated bulk operations likegit add -A.
Audit Metadata