changelog-release-notes
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill incorporates a step to run
git log --oneline <baseline_tag>..<target_tag>to assist in identifying key features for the release notes. Since the tags are provided as user input, this creates a potential surface for command injection if the underlying tool-calling interface does not properly sanitize shell arguments. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from existing Markdown files in the repository to generate summaries and perform translations.
- Ingestion points: The agent reads content from files at
CHANGELOG/zh_CN/CHANGELOG-<major.minor>.md. - Boundary markers: The instructions direct the agent to identify specific blocks based on Markdown headers (e.g.,
# v4.2.0-rc.4), but there are no explicit delimiters or instructions to ignore embedded commands within those blocks. - Capability inventory: The skill possesses file read/write capabilities and the ability to execute shell commands (
git). - Sanitization: No specific sanitization or filtering of the input text from the files is mentioned before processing.
Audit Metadata