release-prep
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests repository data such as Git commit messages and package configuration files to generate release documentation and changelogs. It lacks explicit delimiters or instructions for the agent to isolate and ignore potentially malicious content embedded in this external data.\n
- Ingestion points: Git commit history and
package.jsoncontent as referenced inreferences/prepare-release.md.\n - Boundary markers: Absent in the delegation prompt templates used for subagents.\n
- Capability inventory: The skill utilizes
Bashfor build and Git operations,Writefor updating changelogs and documentation, andTaskfor subagent delegation (referenced inreferences/prepare-release.md).\n - Sanitization: Absent; the skill does not define any validation or filtering logic for ingested content before processing.\n- [COMMAND_EXECUTION]: The skill relies on the
Bashtool to perform sensitive operations such as running test suites, executing production builds, and performing Git operations. While these capabilities are appropriate for release engineering, they represent a significant attack surface that could be leveraged if an indirect prompt injection were to occur.
Audit Metadata