changelog
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the GitHub CLI (
gh),date, andgitto retrieve work history and repository context. The argument parsing logic includes validation for integers (days) and strictly matches allowed flags, preventing shell injection from user-supplied parameters. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a data aggregator, ingesting external content that could potentially contain malicious instructions.
- Ingestion points: The skill reads pull request titles/bodies from GitHub and issue titles from Linear (via MCP).
- Boundary markers: Instructions mandate wrapping the final output in four-backtick fences (
) to isolate the rendered markdown and prevent inner code blocks from breaking the agent's response structure. - Capability inventory: The skill is granted
Bash,Read, andWritecapabilities. WhileWriteis allowed, the instructions explicitly advise against writing to files unless requested by the user. - Sanitization: The skill implements sanitization rules, such as stripping emojis and trailing punctuation from titles, and a "jargon strip-list" for the general audience mode to ensure the output remains focused on high-level summaries.
Audit Metadata