ovs-notes
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script at
harness/scripts/ovs-notes.pyto retrieve and format release notes. It also utilizes dynamic context injection syntax (e.g.,!python3 ...) to provide immediate examples of command execution. - [EXTERNAL_DOWNLOADS]: Interfaces with external GitHub repositories, specifically
Rheinmir/setup, via theghcommand-line tool. This resource is controlled by the vendor/author and is consistent with the skill's purpose. - [PROMPT_INJECTION]: The skill ingests and displays external text (changelogs and release notes) which constitutes an attack surface for indirect prompt injection.
- Ingestion points: Fetching remote release content from the
ghCLI and local git tags. - Boundary markers: There are no explicit delimiters or instructions provided to the agent to disregard instructions potentially embedded within the changelog text.
- Capability inventory: The skill environment allows for subprocess execution (Python) and network operations (via
gh). - Sanitization: The instructions do not specify any validation or sanitization of the content retrieved from external repositories.
Audit Metadata