cmd-pr-description
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to determine the repository's base branch using
gh repo view,git remote show, andgit symbolic-ref.\n- [COMMAND_EXECUTION]: A potential command injection surface exists when the skill uses the$BASE_BRANCHvariable in commands likegit diff $BASE_BRANCH --stat. If the base branch name is fetched from a compromised repository configuration or provided by a user with malicious intent, it could contain shell metacharacters.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it ingests and processes untrusted content from the repository's history and diffs to generate a summary.\n - Ingestion points: Repository diffs and commit logs via
git diffandgit log(SKILL.md).\n - Boundary markers: Absent. The instructions do not provide delimiters or warnings to the agent to disregard instructions embedded within the git data.\n
- Capability inventory: Execution of
gitandghCLI tools (SKILL.md).\n - Sanitization: Absent. There is no evidence of filtering or escaping logic applied to the external git data before it is processed by the agent.
Audit Metadata