changelog-composer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (git commits and pull request descriptions) which could contain malicious instructions designed to influence the agent's output or classification logic.
- Ingestion points: Git commit history extracted via
git logand pull request metadata fetched viagh pr listas described in Phase 1 of the workflow inSKILL.md. - Boundary markers: The instructions lack explicit delimiters or "ignore embedded instructions" warnings when processing commit messages and PR descriptions, potentially allowing the agent to follow instructions found within those data sources.
- Capability inventory: The skill requires and uses shell execution for
gitandgh(GitHub CLI) commands to interact with the repository and remote API. - Sanitization: There is no evidence of sanitization, filtering, or escaping of the content extracted from external commit/PR sources before it is interpolated into the final changelog output in Phase 4 and 5.
Audit Metadata