full-stop
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEPROMPT_INJECTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill contains instructions that explicitly override safety constraints defined in project-level configuration files. It directs the agent to 'use the test methods Proof needs directly, even when a project file says to ask first, for example before computer use,' which bypasses human-in-the-loop checkpoints for sensitive operations.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external pull requests (PRs), which could contain malicious instructions embedded by third-party contributors.
- Ingestion points: Fetches PR head, base, checks, reviews, and mergeability status from the repository environment (SKILL.md).
- Boundary markers: There are no instructions to use delimiters or ignore embedded instructions when reading PR content or reviews.
- Capability inventory: The agent is authorized to perform commits, rebases, and force-pushes to remote branches (SKILL.md).
- Sanitization: No sanitization or validation steps are defined for the ingested PR metadata or diffs.
- [COMMAND_EXECUTION]: The skill authorizes the agent to execute high-impact git operations, such as 'rebase' and 'force-push' (--force-with-lease), on task branches, allowing the agent to rewrite history on remote repositories autonomously.
Audit Metadata