git-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill directs the agent to execute various shell commands for version control and project management, including
git(for commits, branches, and merging),npm/npx(for package installation and running automation tools), and the GitHub CLIgh(for creating and merging pull requests). - [DYNAMIC_EXECUTION]: As part of its configuration guidance, the skill generates shell scripts for git hooks, specifically writing commands to
.husky/pre-commitand.husky/commit-msgto automate linting and commit message validation during the local development lifecycle. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data by interpolating user-provided inputs like ticket IDs and commit descriptions into PR and commit templates.
- Ingestion points: Data enters the system via commit subjects and PR body content placeholders defined in
SKILL.mdandreference/commit-examples.md. - Boundary markers: Instructions are structured using standard Markdown headers and XML-like tags such as
<conventional_commits>and<pr_templates>. - Capability inventory: The skill performs file writes to the project's
.husky/directory and agent-specific telemetry paths (~/.claude/skill-analytics/), and executes system commands throughgit,npm, andgh. - Sanitization: There are no explicit instructions for escaping or validating user-supplied content before it is processed into final commit or PR messages.
Audit Metadata