stage-commit-push
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
git pushcommand to synchronize local changes with a remote repository, which is its primary stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by wrapping git operations. The data processed during the workflow (such as file names or commit messages handled by the
/stage-commitdependency) can originate from untrusted sources. - Ingestion points: SKILL.md (via delegation to /stage-commit).
- Boundary markers: None present.
- Capability inventory: Executes shell command
git pushviaSKILL.md. - Sanitization: None detected in this wrapper script.
Audit Metadata