twg-responsibility-routing

Pass

Audited by Gen Agent Trust Hub on Aug 11, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the twg command-line utility (e.g., twg rovo search, twg responsibility get) to retrieve organizational and project data. These commands are specific to the Atlassian Teamwork Graph ecosystem and are necessary for the skill's stated purpose.
  • [DATA_EXPOSURE]: The skill is designed to access and aggregate organizational information such as hierarchy (org-tree), pull request history (pr-tree), and Jira work items (workitem-tree). This data access is managed through the twg tool and is used to identify relevant personnel for specific workstreams.
  • [PROMPT_INJECTION]: The skill processes data from external sources like Confluence and Jira search results. While this creates a surface for indirect prompt injection if those platforms contain adversarial instructions, the risk is mitigated by the skill's specific focus on extracting roles and evidence rather than executing arbitrary instructions from the content.
  • Ingestion points: Data enters the context via twg rovo search and twg work search results from Confluence and internal work systems.
  • Boundary markers: Explicit delimiters for the tool output are not defined in the skill instructions.
  • Capability inventory: The skill uses the twg CLI to perform searches and infer responsibilities based on retrieved evidence.
  • Sanitization: The instructions do not specify explicit sanitization or filtering of the retrieved content before role classification.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 11, 2026, 07:04 AM
Security Audit — agent-trust-hub — twg-responsibility-routing