issue-pack
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by ingesting untrusted data to generate instructions for downstream implementation agents.
- Ingestion points: In
SKILL.mdunder Step 1 (Process), the agent is instructed to read 'work body, comments or receipts, triage notes, issue-grill notes, existing PRD or package, containment and dependency relationships, blockers, linked implementation artifacts, and attachments'. These sources often contain untrusted user-generated content. - Boundary markers: Absent. The instructions do not define delimiters or specific warnings to ignore instructions embedded within the processed source material.
- Capability inventory: In
SKILL.mdunder Step 5 (Process) and Step 6 (Report), the agent has the capability to 'Publish through the configured backend', 'Set public ready state', and 'Write containment and dependency relationships'. While it does not execute shell commands, its output ('ready-for-agent' work) serves as the primary instruction set for autonomous implementation subagents. - Sanitization: Absent. There is no instruction to filter, escape, or validate the content extracted from external sources before including it in the synthesized 'Package Contract'.
Audit Metadata