final-release-review
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection: The skill processes external data such as Git commit logs, diffs, and GitHub PR descriptions and comments, which could potentially contain malicious instructions intended to influence the agent's release recommendation. Mandatory Evidence Chain: (1) Ingestion points: Data is ingested from Git history and GitHub PR metadata via tools described in SKILL.md and references/review-checklist.md. (2) Boundary markers: The skill lacks explicit data delimiters or instructions to ignore embedded commands within the ingested content. (3) Capability inventory: The agent is authorized to execute Git commands and read repository configuration files (SKILL.md). (4) Sanitization: No explicit sanitization or filtering of the external PR or commit text is specified. While this surface exists, the skill mitigates risk by requiring independent verification of claims against a deterministic gate policy.
Audit Metadata