git-topic-commit-push
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Git commands to inspect, commit, and push changes. This is standard functionality for repository management. Evidence: Use of git status, git diff, git add, git commit, and git push in SKILL.md.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the local file system (via git diff) to summarize changes, creating an attack surface where instructions inside files could influence the agent. Ingestion points: Git context collection in SKILL.md. Boundary markers: Absent for diff content. Capability inventory: git add, git commit, git push in SKILL.md. Sanitization: Absent, but explicit Safety Rules direct the agent to ignore secrets and credentials.
Audit Metadata