understand-change
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill identifies and processes untrusted data from external sources such as git commit messages, pull request descriptions, and plans to build an interactive understanding checklist. While this is the core function of the skill, it represents a surface for indirect prompt injection.\n
- Ingestion points: The skill reads PR descriptions, plans, commit messages, and code files (SKILL.md, Step 2).\n
- Boundary markers: The instructions do not specify the use of delimiters or 'ignore embedded instructions' warnings when processing these external strings.\n
- Capability inventory: The agent is granted permission to read repository files, execute git commands, write local markdown files, and use debugging tools.\n
- Sanitization: There is no mention of sanitizing or escaping the content retrieved from PRs or commits before it is used to influence the tutoring flow.\n- [COMMAND_EXECUTION]: The skill utilizes git commands (
git status,git diff) and debuggers to analyze changes and provide evidence during the tutoring process. These are standard development operations scoped to the local environment and are essential for the skill's stated purpose of helping the user understand code changes.
Audit Metadata