commit
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various Git and initialization commands as part of its primary workflow.
- Runs
git status,git stash,git pull, andgit committo manage repository state. - Executes
npx husky initto set up Git hooks for the project. - Configures and executes
gitleaks protectto scan staged files for potential secret leaks before committing. - [EXTERNAL_DOWNLOADS]: The skill fetches external packages during the initialization process.
- Uses
npxto download and run thehuskypackage from the official npm registry. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the project metadata it analyzes.
- Ingestion points: Reads
package.json, commit histories, documentation, and conversation context to determine commit message formatting and GitHub issue references. - Boundary markers: No delimiters or instructions are used to prevent the agent from obeying instructions embedded in the analyzed code or documentation.
- Capability inventory: The skill has the ability to execute shell commands (
git,npx) and write configuration to local files (Husky hooks). - Sanitization: No validation or sanitization is performed on context-derived strings before they are incorporated into Git messages or command flows.
Audit Metadata