last-tag
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository's git history (commit messages, author names, and tags) and interpolates it into the agent's context.
- Ingestion points: Git metadata retrieved via git log and git show commands in SKILL.md.
- Boundary markers: The skill does not define specific delimiters to separate potentially malicious commit messages from agent instructions.
- Capability inventory: The skill uses the Bash tool to interact with the local file system and execute git commands.
- Sanitization: There is no explicit sanitization or escaping of the commit content before it is processed by the agent.
- [DYNAMIC_EXECUTION]: The skill constructs and executes shell commands where parameters such as TAG and HASH are dynamically populated from prior command outputs or user input. While the instructions advise against command substitution to improve reliability, the tool still generates executable commands from external strings.
Audit Metadata