changelog
Pass
Audited by Gen Agent Trust Hub on Apr 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
git logcommand to extract commit and PR data. This is a benign use of system commands for the skill's primary function. - [SAFE]: The skill reads local project files (
.acumen/features.md,.acumen.md) to ground its analysis in business context. This file access is legitimate and restricted to the project directory. - [SAFE]: The skill processes untrusted data from commit messages and pull requests (Ingestion point: git log output). It lacks explicit boundary markers to separate this data from instructions. The capability inventory is limited to local shell commands and file reading (Capability inventory: git log), with no network or write access. No sanitization of the git history is performed (Sanitization: absent).
Audit Metadata