aep-git-ref
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill outlines a workflow where the agent ingests data from external sources to drive its actions.\n
- Ingestion points: The agent is instructed to read
tasks.mdand files within theopenspec/directory to implement changes and generate commit messages.\n - Boundary markers: There are no specific instructions or delimiters provided to isolate untrusted data in these files from the agent's core instructions, creating a risk that malicious input could influence the agent's behavior.\n
- Capability inventory: The skill grants the agent extensive control over the git repository, including branch management, committing code, and pushing to remote repositories via
gitand the GitHub CLI (gh).\n - Sanitization: No sanitization or validation mechanisms are described for the data read from the task or specification files.\n- [COMMAND_EXECUTION]: The skill includes numerous templates for bash commands that execute
gitandgh. While these are standard for the skill's purpose, they provide a powerful capability tier that could be exploited if the agent follows malicious instructions from an external file.
Audit Metadata