quick
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands via the Bash tool for task ID generation, branch management, and git commits. It dynamically constructs branch names using a 'brief-kebab-description' derived from the user's task. While the instructions specify a kebab-case format which implies sanitization, there is a theoretical risk of command injection if the agent fails to sanitize the user-provided description before passing it to the shell.
- [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection as it ingests untrusted user tasks and repository content while possessing file-write (Edit) and shell-execution (Bash) capabilities.
- Ingestion points: Task descriptions provided in the invocation and repository-level files like CLAUDE.md and STATE.md.
- Boundary markers: The skill uses structural boundary markers in the form of 'Banners' (DISCUSS, Inline Plan, Completion) to separate planning from execution.
- Capability inventory: Uses 'Edit' for file modifications and 'Bash' for branch creation, committing, and ID generation (via
date). - Sanitization: Relies on the agent following the 'inline plan' and 'kebab-description' instructions to validate and structure the workflow before execution.
Audit Metadata