ai-forge-apply
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to parse and execute a numbered improvement list retrieved from the conversation context (Step 1: 'Parse the numbered improvement list from context'). This represents an attack surface where maliciously crafted instructions in the context could attempt to influence the agent's actions.
- Ingestion points: Improvement list parsed from conversation context in
SKILL.md. - Boundary markers: The workflow uses status symbols (
[ ],[✓]) and explicit user prompts for each item to establish boundaries, though it lacks specific delimiters for the ingested context data itself. - Capability inventory: The skill has capabilities to modify files and perform git operations (branch, stage, commit).
- Sanitization: The skill relies on Human-In-The-Loop (HITL) review rather than automated sanitization. Each change must be explicitly approved by the user (
(a)pprove, (r)evise, (s)kip...). - [COMMAND_EXECUTION]: The skill manages git operations including branch creation and commits. These are protected by multiple safeguards: they are opt-in only, require explicit confirmation before execution, and are restricted to specific branch patterns (
ai/*). - Evidence: 'NEVER commit unless git mode was explicitly opted into', 'NEVER commit or push on a non-ai/* branch', and 'Create ai/ branch? (y)es / (n)o'.
Audit Metadata