commit-report
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local
gitandgh(GitHub CLI) commands to fetch repository history, pull request status, and comments. It also includes an optional feature to run a local analysis script from a related skill (sentinel). These operations are consistent with the tool's intended use for development reporting.\n- [INDIRECT_PROMPT_INJECTION]: The skill handles external, user-generated data such as commit messages, PR descriptions, and comments which are considered untrusted input.\n - Ingestion points: Data is collected through
git logandgh searchcommands as defined in the workflow section ofSKILL.md.\n - Boundary markers: The skill lacks formal delimiters but instructs the agent to synthesize data rather than repeating it verbatim, providing a natural buffer against instruction following from processed text.\n
- Capability inventory: The skill possesses the ability to execute shell commands and write files to the local filesystem via the
--docflag.\n - Sanitization: The skill includes an explicit instruction to summarize content rather than outputting raw data if sensitive information like secrets or tokens are detected in commit or PR bodies.
Audit Metadata