commit-workflow

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill manages standard git operations including git commit, git push --force-with-lease, and git rebase. These commands are standard for the skill's intended purpose and are restricted to publication-related tasks.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from the repository environment that could be influenced by external sources, such as git diffs and pull request descriptions.
  • Ingestion points: Local git staged diffs, branch names used for tracker keys, and pull request body content derived from commit subjects (documented in references/current-guidance.md).
  • Boundary markers: The skill implements explicit "Commit Readiness Gates" and "Safety Audit" policies to validate inputs before processing.
  • Capability inventory: The skill possesses capabilities for local file system changes (commits), network operations (pushing to remote repositories), and execution of platform-specific tools (agent-hook).
  • Sanitization: The instructions mandate explicit checks for secrets, private data, local environment files, and debug logs within the staged diffs before any commit or push action is performed.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 05:22 AM