express
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from the local environment via the
git status --porcelaincommand. If a repository contains files with maliciously crafted names, these could theoretically be interpreted as instructions by the agent. - Ingestion points: The skill executes
git status --porcelainwithinSKILL.mdto check for uncommitted changes. - Capability inventory: The skill is authorized to use powerful tools including
Bash,Write,Edit, andAgent, creating a capability surface for potential exploitation if the agent is influenced by the command output. - Boundary markers: The instructions do not specify any markers or negative constraints to ensure the agent ignores content within the git command's output.
- Sanitization: The skill lacks logic to sanitize or validate the output of the git command before the agent acts upon the repository state.
Audit Metadata