git-pushing
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Bash script and several
gitcommands (such asupdate-refandcommit-tree) to manage the repository state. These operations are restricted to the local filesystem and the configured Git remotes. - [SAFE]: The implementation incorporates advanced safety measures, including the use of an isolated temporary index to build commits without affecting the existing working state, and manual acquisition of
.git/index.lockto prevent race conditions during atomic operations. - [DYNAMIC_EXECUTION]: The script supports the execution of standard Git hooks (e.g.,
pre-commit,commit-msg) usinggit hook run. This is standard Git behavior and allows for local repository policy enforcement. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied text for commit messages. It mitigates potential injection or command-breakout risks by validating the message against a strict conventional commit regex and passing the message to Git via a file (
-F) rather than as a direct command-line argument.
Audit Metadata