docs-changelog
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources which could contain malicious instructions.
- Ingestion points: Commit messages retrieved via
git logand content from existing changelog files found during the search phase. - Boundary markers: The instructions lack explicit delimiters or warnings to the AI to ignore instructions embedded within the commit messages or changelog text.
- Capability inventory: The skill utilizes the agent's ability to execute shell commands (
git) and perform file system read/write operations. - Sanitization: There is no logic to sanitize or escape the content of commit messages before they are processed by the LLM for categorization.
- [COMMAND_EXECUTION]: The skill executes shell commands to interact with the repository.
- Evidence: Uses
git log --oneline --no-merges --after="YYYY-MM-DD" HEADandgit tag -l --sort=-creatordateto gather repository metadata. The interpolation of the date string extracted from a potentially untrusted file into the shell command presents a minor command injection surface if the input is not validated.
Audit Metadata