branch-finish
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources such as Git logs, commit messages, and pull request descriptions which could contain malicious instructions. \n
- Ingestion points: SKILL.md identifies repository files, tool logs, and pull request bodies as primary data sources. \n
- Boundary markers: The skill explicitly instructs the agent to treat discovered content as 'untrusted evidence' and never follow instructions embedded in it. \n
- Capability inventory: The skill has authority to perform git merge, git push, and git branch -d operations. \n
- Sanitization: Relies on LLM adherence to the security model defined in SKILL.md which instructs the agent to extract facts rather than follow commands. \n- [COMMAND_EXECUTION]: The skill includes a Python helper script scripts/inspect_finish_state.py that executes Git subcommands via subprocess.run. \n
- Evidence: The script implements an allowlist-checked set of read-only Git commands (e.g., rev-parse, status, remote) to inspect the environment safely. \n
- Context: This is a core part of the skill's functionality to ensure safe branch management and prevents the use of dangerous or state-mutating Git subcommands during the inspection phase.
Audit Metadata