compare-generations
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (
tuistandgit) using variables derived from user input, such as generation IDs and branch names. This interpolation requires safe parameter handling to prevent shell injection. - [INDIRECT_PROMPT_INJECTION]: The skill processes JSON data from tool outputs which may contain untrusted content from the project being analyzed, such as target names or commit messages.
- Ingestion points: JSON output from
tuist generate list --jsonandtuist generate show <id> --json. - Boundary markers: None specified in the instructions.
- Capability inventory: Execution of
tuistandgitCLI tools as described inSKILL.md. - Sanitization: No validation or sanitization of the command output is performed before analysis.
Audit Metadata