clean-stop
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to autonomously run shell commands using
gitand the GitHub CLI (gh) to manage branches, commits, and pull requests. - [DATA_EXFILTRATION]: The skill performs automated uploads of local session context, including diffs and terminal output, to remote git repositories. Although it targets user-controlled remotes and includes a mandatory redaction step, it involves the automated transmission of local session context to external infrastructure.
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection by processing untrusted data to generate remote content. 1. Ingestion points: Reads uncommitted changes, stashes, and terminal scrollback from all touched repositories and worktrees (SKILL.md, Steps 1 and 3). 2. Boundary markers: The instructions lack explicit boundary markers or delimiters for separating ingested data from generated instructions in PR or issue bodies. 3. Capability inventory: The skill utilizes
git push,gh pr create, andgh issue createto write to remote servers. 4. Sanitization: A mandatory redaction pass is required by the instructions in Step 3 to remove secrets, credentials, and PII before transmission.
Audit Metadata