twg-status-rollups
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of the
twg(Teamwork Graph) command-line interface to gather data across various surfaces like Jira issues, pull requests, and organization structures. It includes instructions for locating the binary in standard user directories on macOS, Linux, and Windows. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and summarize data from external, user-controllable sources such as Jira issue descriptions, pull request comments, and Confluence pages. This content may contain instructions that could theoretically attempt to influence the agent's output during the synthesis phase.
- Ingestion points:
twg work query,twg pull-requests query, andtwg projects querycommands (referenced inSKILL.mdandreferences/personal-work-summary.md). - Boundary markers: The instructions do not explicitly mandate the use of delimiters or warnings to the model when processing these external data points.
- Capability inventory: The agent has the capability to execute the local
twgCLI tool and generate summaries. - Sanitization: No specific sanitization or filtering of the retrieved artifact content is mentioned in the instructions.
Audit Metadata