release-notes-for-humans
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted repository data including commit messages, pull request descriptions, and source code comments to generate release notes. * Ingestion points: Workflow and Evidence Inventory sections in SKILL.md cover processing of repository history and user-supplied drafts. * Boundary markers: The Instruction Authority section in SKILL.md explicitly requires that untrusted data be delimited and left unchanged. * Capability inventory: Capabilities are limited to read-only analysis of the repository; the skill explicitly disclaims authority for mutations like tagging or code changes. * Sanitization: Relies on delimiting untrusted content and following a strict instruction hierarchy to prevent data from being interpreted as instructions.
- [EXTERNAL_DOWNLOADS]: The skill can optionally fetch additional editorial instructions from the author's public GitHub repository. * Evidence: references/optional-peer-human-facing-writing.md details the process for fetching the human-facing-writing skill from github.com/porada/domfiles.
Audit Metadata