sensible-commit-flow
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data from the repository, such as git diffs and commit logs, which are potential vectors for indirect prompt injection. This risk is addressed through explicit instruction boundaries.
- Ingestion points: Diff evidence and repository history are processed in the 'Inspect Changes' and 'Update Commit History' workflows.
- Boundary markers: The skill includes a mandatory 'Instruction Authority' section (SKILL.md) requiring the agent to treat tool output and task material as untrusted data and to use delimiters when incorporating it.
- Capability inventory: The skill uses git operations (commit, rebase, push) to modify the repository state based on the processed content.
- Sanitization: Instructions mandate that untrusted content must not expand the current task authority and must be kept separate from active instructions.
- [EXTERNAL_DOWNLOADS]: The skill includes an optional mechanism to fetch additional writing guidelines from the author's public repository.
- Evidence: The 'Optional Peer' workflow (references/optional-peer-human-facing-writing.md) describes fetching content from GitHub.
- Mitigation: The workflow requires user confirmation, employs immutable commit identifiers for snapshotting, and enforces strict validation of the fetched files to ensure they remain within the vendor's repository and declared scope.
Audit Metadata