commit-workflow
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill manages standard git operations including
git commit,git push --force-with-lease, andgit rebase. These commands are standard for the skill's intended purpose and are restricted to publication-related tasks. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from the repository environment that could be influenced by external sources, such as git diffs and pull request descriptions.
- Ingestion points: Local git staged diffs, branch names used for tracker keys, and pull request body content derived from commit subjects (documented in
references/current-guidance.md). - Boundary markers: The skill implements explicit "Commit Readiness Gates" and "Safety Audit" policies to validate inputs before processing.
- Capability inventory: The skill possesses capabilities for local file system changes (commits), network operations (pushing to remote repositories), and execution of platform-specific tools (
agent-hook). - Sanitization: The instructions mandate explicit checks for secrets, private data, local environment files, and debug logs within the staged diffs before any commit or push action is performed.
Audit Metadata