fetching-work-item
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for read-only platform interaction. It explicitly limits its scope to fetching data and writing local snapshots, avoiding any platform mutations, local staging, or commits.
- [SAFE]: Implements security-focused sanitization. The
retrieval-playbook.mdincludes a mandatory rule to rewrite Markdown headings in retrieved content to bold labels, preventing structural collisions or indirect injection attacks that could affect downstream agent phases. - [SAFE]: External resource references are restricted to documentation from well-known services (Atlassian, GitHub, Anthropic). The skill establishes a strict fetch policy that limits the number of pages retrieved and ensures they are used only for API syntax and rationale, not for executing code.
- [SAFE]: Clear delegation and least-privilege principles are applied through the use of a specialized subagent (
work-item-retriever) and structured handoffs (12-line summary), which prevents raw platform payloads from polluting the main coordinator's context.
Audit Metadata