release-readiness
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from source code diffs and repository-owned checklists while having the capability to execute build and deployment commands, which creates an attack surface for indirect prompt injection.\n
- Ingestion points: According to
references/current-guidance.md, the workflow ingests a "final diff" (Step 2), "repo-owned release checklist" (Reading Scope), and "environment config" (Step 5).\n - Boundary markers: The instructions lack explicit delimiters or warnings to help the agent distinguish its internal instructions from potentially malicious content embedded within the analyzed diffs or configuration data.\n
- Capability inventory: The skill instructs the agent to "run missing or invalidated build, package, migration, signing, or smoke checks," which are powerful command execution capabilities.\n
- Sanitization: There is no mention of sanitizing or validating the external content before the agent processes it.
Audit Metadata