merge-resolve
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- Indirect Prompt Injection (LOW): The skill is designed to ingest and process external, untrusted content from git merge conflicts.
- Ingestion points: Conflict markers within repository files as described in the workflow section of SKILL.md.
- Boundary markers: Absent. There are no instructions to the agent to treat conflict content as data rather than instructions.
- Capability inventory: The skill workflow mentions running "validation steps," which implies the execution of build or test commands in the environment.
- Sanitization: No sanitization or validation of the input code is specified before resolution or validation execution.
- No Executable Code (SAFE): The skill consists solely of a markdown file with high-level workflow descriptions and contains no scripts, binaries, or package manifests.
Audit Metadata