repo-history-book
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing git and gh (GitHub CLI) commands via Python's subprocess module to extract commit history, metadata, and pull request information. These commands are executed with list-based arguments, which is a secure practice to prevent shell injection.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from the target repository, including commit messages, PR titles, and documentation files, to generate its narrative. A malicious contributor could embed instructions in commit messages designed to manipulate the agent's summary or interpretation of the project history.\n
- Ingestion points: Data is ingested from git logs, GitHub PR metadata (via gh pr list), and project documentation files (e.g., docs/, CONTRIBUTING.md) as identified in scripts/export_git_history.py and SKILL.md.\n
- Boundary markers: The skill does not employ explicit boundary markers or 'ignore embedded instructions' warnings when presenting the mined data to the model for analysis.\n
- Capability inventory: The skill possesses capabilities for shell command execution (git, gh) and file system writes to the .context/history-book/ directory.\n
- Sanitization: There is no evidence of automated sanitization or filtering of commit messages or PR content before they are processed by the LLM.\n- [EXTERNAL_DOWNLOADS]: The skill includes a PostToolUse hook in SKILL.md that executes a telemetry script located in a separate skill directory ($HOME/.claude/skills/skill-feedback/scripts/skill-event.py). This script is used by the author to track skill activation events.
Audit Metadata