generating-patches
Warn
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The use of
git diff --name-only | xargs fileinSKILL.mdis a vulnerable shell pattern. Becausexargsis used without the-0flag, it incorrectly parses filenames containing spaces or shell metacharacters. In certain environments, this could be exploited by a repository containing specially crafted filenames to execute unintended arguments or commands.\n- [DATA_EXFILTRATION]: The skill instructs the agent to executegit add -Aand subsequently export a diff to/mnt/user-data/outputs/. This workflow blindly incorporates all files in the working directory into the patch file. If the environment contains sensitive information such as.envfiles, SSH keys, or cloud credentials, these will be captured in the patch and made available for download, leading to accidental data exposure.\n- [PROMPT_INJECTION]: The skill operates on arbitrary codebase content, which presents a surface for indirect prompt injection attacks.\n - Ingestion points: Reads file content through
git diffand direct filesystem access inSKILL.md.\n - Boundary markers: The prompt lacks delimiters or specific instructions to the agent to ignore any potential AI commands embedded within the code being processed.\n
- Capability inventory: The skill enables the agent to execute shell commands and write files to an output directory.\n
- Sanitization: There is no sanitization of the content before it is used to generate summaries or pull request descriptions.
Audit Metadata