jujutsu
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from repository history and commit messages which could contain malicious instructions. \n
- Ingestion points: Repository state is read via jj log, jj diff, and jj status (SKILL.md). \n
- Boundary markers: The skill recommends using JSON templates (-T 'json(self)') for scripted reads in SKILL.md to provide structure, but does not explicitly instruction the agent to ignore natural language instructions within commit data. \n
- Capability inventory: The skill has write capabilities including jj commit, jj squash, and jj git push, plus arbitrary command execution via jj bisect run (SKILL.md). \n
- Sanitization: No specific sanitization or filtering of commit content is mentioned beyond the use of structured output templates.\n- [COMMAND_EXECUTION]: The skill relies on execution of the jj CLI tool for all version control operations. It also documents the use of jj bisect run for automated testing, which executes user-supplied commands. The skill requires user authorization and specific environment prefixes before running potentially destructive or automated execution commands.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes jj git fetch and jj git push to synchronize with remote repositories, involving network operations and data transfer with external Git servers.
Audit Metadata