git-merge-origin-main
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard Git commands to manage repository state. All commands such as
git fetch,git merge, andgit statusare restricted to the local Git worktree and the user's configured remotes. - [DATA_EXFILTRATION]: No evidence of sensitive data harvesting or unauthorized network transmission. The
git fetch originoperation is a standard part of the Git workflow to update remote-tracking branches. - [EXTERNAL_DOWNLOADS]: The skill performs a
git fetch originto synchronize with the remote repository. This is an expected operation for the skill's stated purpose of merging origin/main. - [PROMPT_INJECTION]: The instructions do not contain any patterns attempting to bypass safety filters or override system prompts. The instructions explicitly direct the agent to stop and ask for user intervention in various states.
- [INDIRECT_PROMPT_INJECTION]: The skill has a small attack surface for indirect prompt injection as it processes branch names and file paths from the repository. However, it does not interpolate this data into executable code or safety-critical decisions without human oversight, and it uses standard Git listing tools.
Audit Metadata