changelog

Pass

Audited by Gen Agent Trust Hub on Mar 3, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill operates entirely within the scope of its described functionality, using standard development practices for Git repository management.
  • [COMMAND_EXECUTION]: The skill suggests the use of standard command-line utilities to perform repository operations.
  • Evidence: Use of git log, git describe, git tag, gh release create, and sed for processing history and managing releases.
  • Context: These commands are required for the skill's primary purpose and do not indicate malicious intent.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of Git commit messages, creating a standard injection surface common to documentation tools.
  • Ingestion points: Commit messages retrieved via git log in the 'Generation Process' and 'Workflow Integration' sections of SKILL.md.
  • Boundary markers: The output is structured in Markdown sections, but no specific boundary markers are used to isolate commit text from the agent's parsing logic.
  • Capability inventory: The skill utilizes shell command execution (git/gh) and file system write access (CHANGELOG.md).
  • Sanitization: The logic uses regex patterns (conventionalRegex) to parse commit structures, which provides structural validation but does not sanitize the content of the commit descriptions themselves.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 3, 2026, 09:14 PM