git-workflow

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill directs the agent to execute various shell commands for version control and project management, including git (for commits, branches, and merging), npm/npx (for package installation and running automation tools), and the GitHub CLI gh (for creating and merging pull requests).
  • [DYNAMIC_EXECUTION]: As part of its configuration guidance, the skill generates shell scripts for git hooks, specifically writing commands to .husky/pre-commit and .husky/commit-msg to automate linting and commit message validation during the local development lifecycle.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external data by interpolating user-provided inputs like ticket IDs and commit descriptions into PR and commit templates.
  • Ingestion points: Data enters the system via commit subjects and PR body content placeholders defined in SKILL.md and reference/commit-examples.md.
  • Boundary markers: Instructions are structured using standard Markdown headers and XML-like tags such as <conventional_commits> and <pr_templates>.
  • Capability inventory: The skill performs file writes to the project's .husky/ directory and agent-specific telemetry paths (~/.claude/skill-analytics/), and executes system commands through git, npm, and gh.
  • Sanitization: There are no explicit instructions for escaping or validating user-supplied content before it is processed into final commit or PR messages.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 09:56 AM