merge
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes git commands and local Python scripts by interpolating variables like
{winner}and{session-id}directly into shell commands. This pattern is vulnerable to command injection if identifiers contain shell metacharacters. Evidence:git merge --no-ff hub/{session-id}/{winner}/attempt-1andpython {skill_path}/scripts/session_manager.py --cleanup {session-id}in SKILL.md.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests session-related data and agent IDs which influence subsequent system-level actions, creating a surface for indirect prompt injection. \n - Ingestion points:
{winner},{session-id}, and{base_branch}variables derived from previous agent evaluations or session state (SKILL.md).\n - Boundary markers: The skill instructs the agent to "Confirm with user before merging" and present a diff summary to the user.\n
- Capability inventory: High-privilege git operations (merge, tag, branch deletion) and local script execution capability.\n
- Sanitization: No explicit mention of input sanitization or shell-safe escaping for the interpolated parameters.
Audit Metadata