pre-commit
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the project environment and passes it to secondary AI models for review.\n
- Ingestion points: Git diffs ($DIFF), staged changes,
.forgejo/workflows/files, andalembic.iniconfiguration.\n - Boundary markers: The skill uses a
--- DIFF ---delimiter in Step 6, but lacks explicit instructions for the model to ignore instructions embedded within the code diff itself.\n - Capability inventory: The skill utilizes
Bashfor command execution,Readfor file access, and writes toCHANGELOG.md.\n - Sanitization: Raw diff content and file data are interpolated into prompts and shell scripts without evidence of escaping or sanitization.\n- [COMMAND_EXECUTION]: The skill supports a
--dast <url>parameter which is passed directly to a shell script (dast-runner.sh <url>). This pattern creates a shell command injection surface if the agent does not sanitize the user-provided URL before execution.\n- [PROMPT_INJECTION]: TheLIGHTWEIGHT_PROMPTcontains instructional overrides such as "Ignore style, naming, structure, and suggestions" and "Focus ONLY on...". While intended to scope the companion review task, these patterns represent the use of instruction-override techniques.
Audit Metadata