find-regression-commit
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
git bisect run, a command that automatically executes a test script (an "oracle") against multiple revisions of the source code.\n- [DYNAMIC_EXECUTION]: The workflow relies on the repeated execution of a shell script or command to determine the state of a repository at various points in its history.\n- [INDIRECT_PROMPT_INJECTION]: The skill operates on Git repositories, which are external data sources that could contain malicious instructions or content intended to influence the agent's behavior during the checkout or testing process.\n - Ingestion points: Source code and commit history within the targeted Git repository (referenced in
SKILL.mdandreferences/bisect-workflow.md).\n - Boundary markers: The instructions explicitly mandate the use of an isolated
git worktreeand prohibit the installation of Git hooks to maintain environment integrity. It also recommends using an absolute path for the oracle script located outside the repository to prevent revisions from modifying the test script.\n - Capability inventory: The skill utilizes
git bisect runfor script execution andgit worktreefor filesystem management.\n - Sanitization: No explicit sanitization or static analysis of the repository's content is performed before it is executed or evaluated by the bisect oracle.
Audit Metadata