rea-changelog-update
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from Git history and GitHub metadata to generate public-facing changelogs and PR descriptions.\n
- Ingestion points: Commit messages, PR titles, PR descriptions, and issue reporter identities are fetched from the repository via
scripts/release-notes.mjsand processed by the agent (file:SKILL.md).\n - Boundary markers: The instructions do not specify the use of delimiters or specific "ignore embedded instructions" warnings when interpolating this external data into the agent's context.\n
- Capability inventory: The agent can modify local files (
CHANGELOG.md,docs/releases/) and update remote GitHub pull requests using thegh pr editcommand (file:SKILL.md).\n - Sanitization: The skill relies on manual human review ("reviewed metadata snapshot") and a specific workflow label (
rea:release-notes-finalized) to authorize changes, rather than programmatic sanitization of the ingested content.
Audit Metadata