flow-ticket
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted data from external sources such as ticket connectors, CLI outputs, and attachments.
- Ingestion points: According to
SKILL.md, the skill reads descriptions and attachments from ticket sources to populate local tracking files. - Boundary markers: The instructions lack explicit delimiters or "ignore instructions" warnings to prevent the agent from accidentally executing commands embedded within the retrieved ticket text.
- Capability inventory: The skill has the capability to write files to the project root (creating
.task/andassets/directories), modify.gitignore, and read internal configuration files likeAGENTS.mdandCLAUDE.md. - Sanitization: No sanitization or validation logic is defined for the external content before it is processed or stored locally.
Audit Metadata