analyzing-git-sessions
Warn
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- PROMPT_INJECTION (MEDIUM): The skill processes untrusted external data that can contain malicious instructions.
- Ingestion points: Repository data is ingested via
git logandgit diffinSKILL.md. - Boundary markers: Absent. The skill does not wrap commit messages or code diffs in delimiters in its output to the agent.
- Capability inventory: The skill uses
gitsubprocess calls and the resulting data influences agent reasoning for code reviews and PR descriptions. - Sanitization: Absent. The skill provides no mechanism to filter or escape instructional content within commit messages.
- COMMAND_EXECUTION (MEDIUM): Use of shell variables in git command templates without sanitization.
- Evidence:
SKILL.mdincludes logic that interpolates variables like<range>,<start>,<end>, and$moduledirectly into shell command strings (e.g.,git diff <start>..<end> -- $module/). If these variables are derived from malicious repository metadata (e.g., a branch name containing shell metacharacters), they could lead to command injection.
Audit Metadata