walkthrough
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is restricted to read-only git operations. Instructions explicitly forbid state-changing actions such as
git checkout,git reset, orgit commit.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from git logs, commit messages, and repository source code.\n - Ingestion points: The skill reads commit history via
git log, commit details viagit show, and local file content (e.g., README, source files) as defined inSKILL.md.\n - Boundary markers: None explicitly mentioned in the instructions to isolate commit messages from other content.\n
- Capability inventory: Tool access is limited to read-only git commands and file reading; no network access or arbitrary shell execution beyond git is permitted.\n
- Sanitization: No specific input sanitization is described, although the agent is instructed to verify commit messages as 'claims' against the actual code.
Audit Metadata