smart-merge
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill accesses local Git repository metadata and source code (via
git log,git diff, andgit show) to perform branch analysis. This access is necessary for the skill's primary function as a merge assistant. - [COMMAND_EXECUTION]: The skill executes standard development commands such as
git,grep, andgo build. These operations are limited to the local filesystem and the current project context to verify code compatibility. - [INDIRECT_PROMPT_INJECTION]: The skill reads content from Git branches which could contain untrusted data. It uses this data to identify logical conflicts like function signature changes or API contract breaks. Standard developer workflows involving code analysis naturally carry this exposure, and the skill follows best practices by asking for user confirmation before committing changes.
- [PROMPT_INJECTION]: No patterns of instruction overriding, safety filter bypassing, or system prompt extraction were found in the skill instructions.
Audit Metadata