pm-changelog-rewrite
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests technical changelogs which serve as untrusted data that could contain malicious instructions or attempts to influence the agent's behavior.
- Ingestion points: The skill reads technical entries from the source changelog file (
$CHANGELOG_FILE) in Phase 1. - Boundary markers: The skill includes explicit safety rules instructing the agent to treat changelog content as data only and to never follow instructions found within the input.
- Capability inventory: The skill possesses the capability to write and edit local files (
CHANGELOG-PRODUCT.md,settings.yaml) and execute specific shell commands (git add,git commit) via theBashtool. - Sanitization: The skill implements a mandatory human review gate ('HARD STOP') between the analysis phase and the generation phase, requiring explicit user approval before any changes are committed to the file system or git repository.
Audit Metadata