release-digest

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 9:53 PM UTC
• Version: 1.0.0

Overview

This skill locally generates Markdown release notes from git history and does not show hidden network, persistence, publishing, or destructive behavior.

Install is reasonable for local release-note drafting. Use it only on repositories you intend to inspect, and review the generated Markdown before sharing because commit messages, author names, and filenames can contain misleading formatting or sensitive text.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/release-digest.sh:28

Finding

Unsanitized Repository Metadata Can Manipulate Agent-Generated Release Digests

Content

View full analysis

Vulnerability Details

File Location: scripts/release-digest.sh, lines 28-31
Vulnerability Type: Improper neutralization of untrusted repository content
Risk Level: Medium

Vulnerable Code

bash

printf '### Commits\n\n'
git log --no-merges --reverse --format='- %s (%an) `%h`' "$range" 2>/dev/null || true
printf '\n### Files changed\n\n'
git diff --stat "$range" 2>/dev/null || true

The output-handling instruction in SKILL.md, lines 39-41, further directs the agent to return this generated content:

markdown

3. Hand the printed Markdown back to the caller. Never paste secrets, tokens,
   or private filenames that the commit log may surface — redact before replying.

Technical Analysis

The script inserts Git commit subjects (%s), author names (%an), and changed file paths directly into Markdown without escaping Markdown syntax or removing terminal control characters. These values can be controlled by anyone capable of introducing commits or filenames into the audited repository.

Although command arguments are quoted and no shell command injection is present, the generated document crosses a trust boundary: repository-controlled text is returned to an AI agent and subsequently presented to a user. A malicious value may contain instruction-like text, deceptive links, Markdown formatting, backticks, bidirectional text characters, or ANSI terminal escape sequences.

The instruction in SKILL.md requires secret and private-filename redaction but does not require the agent to treat repository-derived content strictly as untrusted data. Consequently, crafted repository metadata could be interpreted as instructions by an agent or could manipulate the appearance of the rendered response.

Attack Path

1. An attacker obtains permission to contribute a commit or create a tracked filename in the target repository.
2. The attacker creates a commit subject, author name, or filename containing malicious Markdown, terminal contro ...[truncated 1187 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat every commit subject, author name, and filename as untrusted data.
2. Strip C0/C1 control characters, ANSI escape sequences, and unsafe bidirectional formatting characters before producing output.
3. Escape Markdown metacharacters in repository-derived values, including backticks, brackets, parentheses, angle brackets, and backslashes.
4. Use NUL-delimited Git output where possible so unusual filenames and record boundaries can be processed safely.
5. Avoid passing raw git diff --stat output directly to the response. Parse structured Git output and render each field through a dedicated sanitizer.
6. Update SKILL.md to state explicitly that repository content is data only and must never be followed as instructions.
7. Consider wrapping untrusted values in a clearly labeled, inert representation rather than interpolating them directly into normal prose.
8. Add regression tests covering ANSI escapes, multiline metadata, Markdown links, backticks, bidirectional characters, and unusual filenames.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.