ovs-notes
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill fetches changelog and release note content from external GitHub repositories and local Git tags. This external content is processed by the agent and could contain hidden instructions designed to manipulate the agent's behavior. Ingestion points: Output from the ovs-notes.py script fetching from GitHub releases or Git tags. Boundary markers: The skill does not define specific delimiters or warnings to ignore instructions within the fetched data. Capability inventory: The skill invokes a Python script which uses CLI tools like gh and git. Sanitization: No sanitization of the fetched external text is described.
- [COMMAND_EXECUTION]: The skill is configured to execute a local Python script (harness/scripts/ovs-notes.py) and interacts with system-level binaries including the GitHub CLI (gh) and Git.
- [DYNAMIC_CONTEXT_INJECTION]: The skill documentation describes and provides examples of using the bang-prefix syntax (!python3 harness/scripts/ovs-notes.py) to execute shell commands at the moment the skill is loaded into the context, bypassing the standard model invocation for performance.
Audit Metadata