git-pushing

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Bash script and several git commands (such as update-ref and commit-tree) to manage the repository state. These operations are restricted to the local filesystem and the configured Git remotes.
  • [SAFE]: The implementation incorporates advanced safety measures, including the use of an isolated temporary index to build commits without affecting the existing working state, and manual acquisition of .git/index.lock to prevent race conditions during atomic operations.
  • [DYNAMIC_EXECUTION]: The script supports the execution of standard Git hooks (e.g., pre-commit, commit-msg) using git hook run. This is standard Git behavior and allows for local repository policy enforcement.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied text for commit messages. It mitigates potential injection or command-breakout risks by validating the message against a strict conventional commit regex and passing the message to Git via a file (-F) rather than as a direct command-line argument.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 08:46 AM
Security Audit — agent-trust-hub — git-pushing