batch-simplify
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses git operations (
git log,git diff) and the GitHub CLI (gh issue create) to manage code review workflows. It includes a dynamic context injection (!git branch) in its metadata to display status, which is a benign use of runtime command execution. The skill also describes a normalization process for user arguments (e.g., converting '48h' to '48 hours') which serves as a safeguard against command injection. - [DATA_EXFILTRATION]: The skill implements a robust exclusion list in Phase 2, preventing the agent from reading or modifying sensitive configuration files in
.claude/,.github/workflows/, and manifest files like.mcp.json. This 'read-only' deferral policy for infrastructure files reduces the risk of credential exposure or configuration tampering. - [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it ingests untrusted code and git metadata.
- Ingestion points: Repository files and git history logs are processed in Phase 6.
- Boundary markers: The instructions lack explicit delimiters to separate untrusted file content from sub-agent instructions.
- Capability inventory: Sub-agents have file-read access, while the main agent has shell access and task management capabilities.
- Sanitization: No specific sanitization of file content is performed before passing data to sub-agents. The skill relies on sub-agent grounding ('preserve ALL functionality') to mitigate risks.
Audit Metadata