commit-report

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses local git and gh (GitHub CLI) commands to fetch repository history, pull request status, and comments. It also includes an optional feature to run a local analysis script from a related skill (sentinel). These operations are consistent with the tool's intended use for development reporting.\n- [INDIRECT_PROMPT_INJECTION]: The skill handles external, user-generated data such as commit messages, PR descriptions, and comments which are considered untrusted input.\n
  • Ingestion points: Data is collected through git log and gh search commands as defined in the workflow section of SKILL.md.\n
  • Boundary markers: The skill lacks formal delimiters but instructs the agent to synthesize data rather than repeating it verbatim, providing a natural buffer against instruction following from processed text.\n
  • Capability inventory: The skill possesses the ability to execute shell commands and write files to the local filesystem via the --doc flag.\n
  • Sanitization: The skill includes an explicit instruction to summarize content rather than outputting raw data if sensitive information like secrets or tokens are detected in commit or PR bodies.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 06:23 PM