epic-tracker

Pass

Audited by Gen Agent Trust Hub on May 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands like grep and echo to automatically manage git ignore rules within the .git/info/exclude file, ensuring project-specific artifacts are not accidentally committed. This is a standard practice for maintaining local tool configuration.
  • [COMMAND_EXECUTION]: It interacts with well-known command-line interfaces (gh, linear, jira) to perform tracker operations when MCP servers are not available, allowing users to integrate with their existing developer tooling.
  • [DATA_EXFILTRATION]: As part of its intended functionality, the skill transfers project information (epic details, story descriptions, bug reports) to external platforms including GitHub, Linear, and Jira. This behavior is transparent, user-initiated, and restricted to the configured tracker domains.
  • [PROMPT_INJECTION]: The skill processes content from external source files such as PRDs and briefs to generate epic drafts. While this presents an indirect prompt injection surface, the risk is mitigated by extracting only specific information and requiring explicit user review before any data is persisted or synchronized.
Audit Metadata
Risk Level
SAFE
Analyzed
May 11, 2026, 12:11 PM