fix-and-ship
Warn
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes extensive shell commands for git operations, cloud deployments (Vercel, Fly.io, Railway, Heroku, Kubernetes), and infrastructure management (AWS CDK, SAM). It also reads and writes telemetry data to the
~/.claude/projects/directory, which contains sensitive agent-specific data.\n- [CREDENTIALS_UNSAFE]: It explicitly searches for sensitive information likeSLACK_WEBHOOK_URLwithin.envand.env.localfiles to facilitate notifications.\n- [DATA_EXFILTRATION]: The skill usescurlto send incident metadata and deployment status to external webhooks extracted from project environment files.\n- [PROMPT_INJECTION]: The skill processes untrusted input from$ARGUMENTS(such as bug descriptions and stack traces) and passes them to the diagnostic phase without sanitization. This creates a vulnerability to indirect prompt injection where malicious data could influence the fix generated and deployed by the agent.\n - Ingestion points:
$ARGUMENTSinSKILL.md(passed to PHASES 0 and 1).\n - Boundary markers: No delimiters or warnings are used for the processed input.\n
- Capability inventory: Subprocess execution of
git,vercel,fly,kubectl,npx,curl, andgh.\n - Sanitization: No validation or escaping is applied to external input before it enters the code generation pipeline.\n- [REMOTE_CODE_EXECUTION]: Runtime deployment commands such as
npx serverless deployandcdk deploytrigger the execution of arbitrary code or logic defined within the project's configuration files.
Audit Metadata