utility-pm-changelog-curator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface for untrusted data since it reads commit histories and messages via
git logcommands. If a repository accepts pull requests from untrusted third parties, malicious instructions embedded within commit headers or bodies could attempt to manipulate the classification or formatting of the final draft. - Ingestion points: Git commit logs and repository histories obtained via
git logcommands parsed inSKILL.md. - Boundary markers: Absent. The instructions do not define strict boundaries or delimiters to encapsulate the git log output away from the primary system prompt constraints.
- Capability inventory: Executes shell utilities (
git log,git status,git describe) but does not independently execute file writes or network transmissions. - Sanitization: Focuses entirely on structural formatting rules (e.g., stripping attribution trailers, avoiding em-dashes) rather than input filtering against behavioral prompt instructions.
- [COMMAND_EXECUTION]: The skill requires the ability to execute system commands to fulfill its primary purpose.
- Evidence: Calls
git log,git describe, andgit statuscommands via bash to collect target version milestones and unreleased changes.
Audit Metadata