version-badge-pattern
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The build configurations for Next.js (
next.config.mjs) and Vite (vite.config.ts) utilizeexecSyncto retrieve Git metadata, specifically the current commit SHA and branch name. These commands are hardcoded and used to populate environment variables during the build process. - [COMMAND_EXECUTION]: The
getChangelogfunction in the build configurations executes a local Node.js script (scripts/parse-changelog.mjs) to generate a JSON representation of the project'sCHANGELOG.mdfile. - [PROMPT_INJECTION]: The skill processes untrusted data from the local filesystem (Category 8 surface). Ingestion points:
CHANGELOG.mdviascripts/parse-changelog.mjs. Boundary markers: None identified. Capability inventory:execSynccalls in build configs and local file read operations. Sanitization: Employs regular expression matching to extract specific version headers and change entries, limiting the influence of arbitrary content in the source file.
Audit Metadata