design-rationale
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting and analyzing data from various external sources, creating a surface for indirect prompt injection. \n
- Ingestion points: SKILL.md (Steps 2 and 3) directs the agent to fetch information from Git logs, PRs, tickets, docs, chat history, and observability tools. \n
- Boundary markers: The instructions do not specify the use of delimiters or warnings to ignore potential instructions embedded in the external content. \n
- Capability inventory: The skill uses
gitandgh(GitHub CLI) and permits the discovery of other host-provided tools. \n - Sanitization: No explicit sanitization or validation of external content is mentioned. \n- [SAFE]: The skill uses standard developer tools for their intended purpose and focuses on logical synthesis of historical information. No evidence of obfuscation, remote code execution, or credential exfiltration was found.
Audit Metadata