to-tickets
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements strict directory scoping by requiring all file operations to resolve to
.agents/projects/within the repository root, explicitly prohibiting access to global agent installation directories. - [SAFE]: A mandatory human-in-the-loop checkpoint is included in the process (Step 3), requiring explicit user approval of ticket drafts before the agent can interact with external trackers.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data from project specifications and external tracker comments.
- Ingestion points: Project specs, ADRs, and tracker comments in Step 1.
- Boundary markers: None explicitly defined for external content.
- Capability inventory: The skill can write to local project files and interact with authenticated Jira/GitHub APIs.
- Sanitization: Not explicitly mentioned; however, the impact is mitigated by the requirement for user approval before any external actions occur.
Audit Metadata