persist-ml-git
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the shell to execute
gitcommands (status,add,commit) and a vendor-specific Python module (skore_skills) to manage ML project states. This provides a direct path for the agent to modify the local filesystem and repository history. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface where untrusted data from the workspace can influence agent behavior:
- Ingestion points: The agent's actions are driven by the JSON output of
python -m skore_skills git end-turnand user-selected file paths within the workspace (SKILL.md). - Boundary markers: There are no explicit delimiters or protective markers surrounding the hook's JSON output, relying on natural language instructions for parsing.
- Capability inventory: The skill possesses the ability to stage and commit files to Git and execute multiple subcommands of the
skore_skillsCLI tool. - Sanitization: While the skill instructs the agent to "Never keep .env or .skore" and to use the
--separator forgit add, it lacks explicit instructions for escaping or quoting dynamically provided path arguments (e.g.,--keep <path>), which could lead to command injection if paths contain shell metacharacters.
Audit Metadata