commit
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by analyzing existing git commit logs, documentation, and code comments to determine project-specific language conventions and commit styles. This data enters the agent context without explicit boundary markers or sanitization, potentially allowing an attacker who can commit to the repository to influence the agent's behavior. Ingestion points include file content via the Read tool and history via git log.
- [COMMAND_EXECUTION]: The skill instructs the agent to perform system configuration tasks including initializing Husky hooks using npx and configuring GitLeaks protection. While these are standard security practices for developers, they involve executing commands and interacting with external package registries.
Audit Metadata