git-task-workspace
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes Git commands (
git worktree) and filesystem operations (rm -rf) to manage isolated task workspaces. These actions are central to the skill's stated purpose of workspace organization. - [INDIRECT_PROMPT_INJECTION]: The skill defines workflows that incorporate external identifiers such as repository names and branch names into shell commands. This presents a theoretical injection surface if the agent is directed to work with repositories containing maliciously crafted names.
- Evidence Chain for Indirect Prompt Injection:
- Ingestion points: Identifying repository names and branch names from the source-pool directory or user input (SKILL.md, references/setup.md).
- Boundary markers: No explicit boundary markers or safety warnings for input sanitization are present in the instructions.
- Capability inventory: Shell execution of git worktree and rm -rf (SKILL.md).
- Sanitization: No sanitization logic for task or branch names is provided in the skill instructions.
Audit Metadata