finishing-a-development-branch
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- Command Execution: The skill instructs the agent to run project-specific commands like
npm test,cargo clippy, andgit push. This allows the agent to perform necessary development tasks but involves executing scripts defined within the user's project repository. - Indirect Prompt Injection Consideration: The agent ingests results from tests, linters, and project configuration files. Because this data is not sanitized and comes from the project environment, it could potentially contain instructions that influence the agent's behavior during the review process.
- Sensitive File Interaction: The skill prompts the agent to copy environment and configuration files (such as
.env) to support local server demos. Users should ensure the agent handles these files securely within the intended local context.
Audit Metadata