commit-push
Pass
Audited by Gen Agent Trust Hub on Feb 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs standard repository management tasks by executing Git commands such as status, diff, log, add, commit, and push.
- [PROMPT_INJECTION]: The skill is exposed to indirect prompt injection by reading untrusted data from the repository during the commit message generation process.
- Ingestion points: File diffs and repository status retrieved through
git diffandgit status. - Boundary markers: Absent; no specific delimiters or protective instructions are used when providing the agent with ingested file contents.
- Capability inventory: Includes commands to modify the local repository (
git add,git commit) and transmit code to a remote tracking branch (git push). - Sanitization: Implements a rule to skip files with secret-related names like
.envor credentials, but does not analyze the internal content for malicious instructions.
Audit Metadata