copy

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill is designed to process external, untrusted data including Git diffs, commit logs, and ticket information to generate PR descriptions and release notes (see Phase 2 in SKILL.md and references/outbound-user.md).
  • Ingestion points: The agent reads technical artifacts such as diffs, commit histories, and repository configuration files.
  • Boundary markers: There are no explicit instructions or delimiters provided to help the agent distinguish between its instructions and the content of the data being processed.
  • Capability inventory: The skill allows writing to local files (.dev-agent/screens/<slug>.strings.md) and executing local analysis scripts.
  • Sanitization: The instructions do not include steps to sanitize or escape the content gathered from the source code or version control history.
  • [COMMAND_EXECUTION]: The reference files (references/i18n.md, references/outbound-user.md, references/style.md) contain templates for Python and Bash scripts that the agent is instructed to execute to 'measure' the repository state, such as checking translation coverage, commit patterns, and stylistic conventions. While these scripts use standard tools like git, json, and re for local analysis, they represent a dynamic execution capability within the skill context.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 03:03 PM
Security Audit — agent-trust-hub — copy