prepare-release
Warn
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands that interpolate data from
git logandgit diffusing shell substitution syntax (e.g.,gemini ... "$(git log ...)"). Since commit messages are user-controlled content, a malicious contributor could include shell metacharacters such as backticks or subshells to execute arbitrary code within the agent's execution environment. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It passes unvalidated git history and code diffs to external LLMs for classification and analysis. An attacker could craft commit messages or code comments that contain instructions to the analyzing LLM, potentially causing it to ignore breaking changes or misreport release features.
- Ingestion points: Git commit messages and file diffs (SKILL.md, Steps 1 and 2).
- Boundary markers: None. Untrusted data is concatenated directly into the prompt strings provided to the LLM tools.
- Capability inventory: Subprocess execution, file system access, and network operations via tool calls.
- Sanitization: None. The skill uses raw outputs from git commands without escaping or validation.
Audit Metadata