Pulling Updates from Skills Repository
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Git command-line tools to check status, fetch updates, and merge changes into the local environment.
- [EXTERNAL_DOWNLOADS]: Fetches updates from the vendor's repository
obra/superpowers-skillsto keep the local installation current. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of Git commit messages and merge conflict content.
- Ingestion points: Commit logs (
git log) and file content during merges (git merge) inSKILL.md. - Boundary markers: None explicitly defined for command output processing.
- Capability inventory: Shell command execution (Git) and file system modifications (merge resolution) in
SKILL.md. - Sanitization: The process includes manual user review checkpoints during conflict resolution to verify changes.
Audit Metadata