skills/misothecod/claude-skills/merge/Gen Agent Trust Hub

merge

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs shell-based operations including Git commands (checkout, merge, tag, and branch -D) to manage project history and execution of a local Python script session_manager.py for worktree cleanup and state management. These actions are directly aligned with the skill's stated purpose.- [INDIRECT_PROMPT_INJECTION]: The skill processes session data such as task descriptions and agent identifiers which are interpolated into Git commit messages and summary files. While this creates a theoretical surface for injection if session metadata is untrusted, the impact is minimized by the skill's specialized context.
  • Ingestion points: Variable placeholders ({session-id}, {winner}, {task}) in SKILL.md are interpolated into Git commands and generated markdown files.
  • Boundary markers: No explicit delimiters or boundary instructions are provided in the command templates.
  • Capability inventory: The skill has capabilities for file system modification (via Git and summary file writing) and local script execution.
  • Sanitization: The instruction template does not demonstrate explicit escaping or validation of session-specific variables before interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 05:46 PM