checkout-commit-push-pr
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The instructions contain explicit directives to override standard agent behavior by mandating total autonomy ("DO NOT ASK ME WHAT TO DO") and suppressing standard AI identity attribution in commit logs ("Do NOT append a Co-Authored-By: Claude trailer").
- [INDIRECT_PROMPT_INJECTION]: The skill reads untrusted content from the local repository (such as the contents of new untracked files and pull request templates) and incorporates this data into commit messages and PR descriptions, creating a potential attack surface.
- Ingestion points: Reading untracked file contents and PR template files in
SKILL.md. - Boundary markers: None are present to distinguish untrusted file content from instructions.
- Capability inventory: The skill has write access to the repository (
git push) and the ability to create pull requests (gh pr create). - Sanitization: There is no evidence of content sanitization or validation before the ingested data is processed or output to the remote origin.
Audit Metadata