review-and-ship
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (code diffs, commit history, and chat history) which could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: Step 1 of the workflow in SKILL.md gathers context from git diffs, uncommitted changes, recent commits, and user chat history.
- Boundary markers: The instructions do not define specific delimiters or warnings to ignore embedded commands within the ingested context.
- Capability inventory: The skill is authorized to run tests (which involves arbitrary code execution in the local environment) and perform git operations such as commit, push, and opening/updating PRs.
- Sanitization: There is no requirement for sanitization or validation of the external content before it is processed by the agent.
Audit Metadata