pre-changelog
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes content from pull request diffs fetched via the GitHub API, which presents a surface for indirect prompt injection where malicious text in a PR could attempt to influence agent behavior. \n
- Ingestion points: Pull request diff data for
apps/kimi-code/CHANGELOG.mdis fetched in the workflow. \n - Boundary markers: No explicit delimiters or instructions are used to treat the fetched content as untrusted data. \n
- Capability inventory: The skill uses
ghfor data retrieval; no capabilities for writing files, executing code, or privilege escalation were identified. \n - Sanitization: The skill applies specific transformation rules (stripping, merging, and translating) that limit how the input text is interpreted and used.\n- [COMMAND_EXECUTION]: The skill utilizes the GitHub CLI tool (
gh) to perform read-only operations such as listing pull requests and querying repository API data within theMoonshotAI/kimi-coderepository to retrieve changelog content.
Audit Metadata