Skills
Navigate
skills/morzecrew/agent-skills/keep-a-changelog/Gen Agent Trust Hub

keep-a-changelog

Pass

Audited by Gen Agent Trust Hub on Sep 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to run a local Python script scripts/validate_changelog.py using python3 to verify file structure.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data, which presents a surface for indirect prompt injection. Ingestion points: The skill extracts information from the user's summary, git commit messages, and PR descriptions as defined in Workflow A of references/spec-and-workflows.md. Boundary markers: The instructions lack explicit delimiters or markers to isolate external data from the agent's core instructions. Capability inventory: The skill possesses the ability to execute a local Python script and modify the CHANGELOG.md file. Sanitization: While the validate_changelog.py script enforces structural rules, it does not sanitize or filter the content of the entries themselves.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 18, 2026, 07:36 PM