ship-this
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard git commands including
git diff,git status,git log,git commit, andgit pushto perform its core functions of reviewing code changes and managing repositories. - [COMMAND_EXECUTION]: The instructions recommend running external security scanning tools such as
gitleaks,trufflehog,git secrets, anddetect-secretsif they are present on the host system to identify leaked credentials. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted input in the form of code diffs, which could theoretically contain malicious content designed to influence the agent's behavior during the review process.
- Ingestion points: The output of
git diffandgit statuscommands executed inSKILL.md. - Boundary markers: None explicitly defined for separating the diff content from instructions.
- Capability inventory: The skill has the capability to execute
git commitandgit pushcommands based on its analysis. - Sanitization: No specific sanitization logic is described for the diff content before it is processed by the AI.
Audit Metadata