mister-smith-git-closure
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local script
scripts/verify_worktree_closure.shto validate the repository state. This script is part of the repository's infrastructure. - [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). It reads untrusted data from GitHub PR comments and reviews via
gh pr view. The instructions direct the agent to evaluate and potentially apply suggested changes from these comments, creating an attack surface where malicious instructions in a comment could influence the agent's behavior. - Ingestion points: External data enters through
gh pr view --commentsand other PR review monitoring commands inSKILL.md. - Boundary markers: Absent. No delimiters or instructions are provided to the agent to treat external comment content as data rather than instructions.
- Capability inventory: The agent can modify the filesystem (apply changes), execute shell commands (
git,cargo, and repo scripts), and perform network operations (git push,gh pr merge). - Sanitization: Absent. There is no validation or filtering of the content retrieved from PR comments before processing.
Audit Metadata