git-notes
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides patterns for executing Git commands to manage notes, configure repository settings, and communicate with remotes. These include
git notes,git log,git config, andgit push, which allow the agent to modify the local environment and share metadata externally. - [INDIRECT_PROMPT_INJECTION]: The skill documents methods to read from and write to Git notes using data from commit history or external files. This creates a vulnerability surface where malicious instructions could be embedded in Git notes and subsequently processed by the agent.
- Ingestion points: Git notes content accessed via
git notes show,git log --notes, and files ingested viagit notes add -Fas described in SKILL.md. - Boundary markers: Absent; there are no instructions or delimiters to distinguish between untrusted metadata and system instructions.
- Capability inventory: The agent can execute Git commands and perform network operations (
git push,git fetch) as detailed in SKILL.md. - Sanitization: Absent; the patterns do not include steps to validate or sanitize the content of Git notes before use.
Audit Metadata