to-tickets
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted external data, which could contain malicious instructions intended to manipulate the agent's output or actions.
- Ingestion points: The skill fetches the full body and comments of external issues and reads project specifications provided via URLs or paths (
SKILL.md). - Boundary markers: There are no instructions provided to the agent to use delimiters or ignore embedded instructions within the external content it fetches.
- Capability inventory: The agent has the ability to explore the local codebase (read), write local files to the
.scratch/directory (write), and publish data to external trackers like GitHub or Linear (network/API). - Sanitization: No sanitization, escaping, or validation logic is defined for the external content before it is interpolated into the agent's context or used to generate tickets.
Audit Metadata